How to connect to a remote Windows machine to execute commands using python

Question

I am new to Python and I am trying to make a script that connects to a remote windows machine and execute commands there and test ports connectivity   Here is the code that I am writing but it is not working  Basically  I want to and it returns with the local machine data  not the remote one   import wmi import os import subprocess import re import socket  sys  def main          host  remotemachine       username  adminaam       password  passpass        server  connects host  username  password       s   socket socket        s settimeout 5       print server run remote  hostname    class connects       def   init   self  host  username  password  s   socket socket             self host host         self username username         self password password         self s s          try              self connection  wmi WMI self host  user self username  password self password              self s connect   10 10 10 3   25               print  Connection established          except              print  Could not connect to machine       def run remote self  cmd  async False  minimized True          call subprocess check output cmd  shell True stderr subprocess STDOUT          print call  main

User · Answer

pypsrp - Python PowerShell Remoting Protocol Client library

At a basic level, you can use this library to;

Execute a cmd command
Run another executable
Execute PowerShell scripts
Copy a file from the localhost to the remote Windows host
Fetch a file from the remote Windows host to the localhost
Create a Runspace Pool that contains one or multiple PowerShell pipelines and execute them asynchronously
Support for a reference host base implementation of PSRP for interactive scripts

REF: https://github.com/jborean93/pypsrp

User · Answer

For connection  c wmi WMI  machine name  user  username  password  password     this connects to remote system  c is wmi object   for commands  process id  return value   c Win32 Process Create CommandLine  cmd exe  c   lt your command gt      this will execute commands

User · Answer

Many answers already  but one more option PyPSExec https   pypi org project pypsexec  It s a python clone of the famous psexec  Works without any installation on the remote windows machine

User · Answer

I don t know WMI but if you want a simple Server Client  You can use this simple code from tutorialspoint   Server   import socket                 Import socket module  s   socket socket             Create a socket object host   socket gethostname     Get local machine name port   12345                  Reserve a port for your service  s bind  host  port            Bind to the port  s listen 5                    Now wait for client connection  while True     c  addr   s accept         Establish connection with client     print  Got connection from   addr    c send  Thank you for connecting      c close                    Close the connection    Client     usr bin python             This is client py file  import socket                 Import socket module  s   socket socket             Create a socket object host   socket gethostname     Get local machine name port   12345                  Reserve a port for your service   s connect  host  port   print s recv 1024  s close                       Close the socket when done   it also have all the needed information for simple client server applications   Just convert the server and use some simple protocol to call a function from python   P S  i m sure there are a lot of better options  it s just a simple one if you want

User · Answer

The best way to connect to the remote server and execute commands is by using  quot wmiexec py quot  Just run pip install impacket Which will create  quot wmiexec py quot  file under the scripts folder in python Inside the python  gt  Scripts  gt  wmiexec py we need to run the wmiexec py in the following way python  lt wmiexec py location gt  TargetUser TargetPassword TargetHostname  quot  lt OS command gt  quot   Pleae change the wmiexec py location according to yours Like im using python 3 8 5 and my wmiexec py location will be C  python3 8 5 Scripts wmiexec py python C  python3 8 5 Scripts wmiexec py TargetUser TargetPassword TargetHostname  quot  lt OS command gt  quot   Modify TargetUser  TargetPassword  TargetHostname and OS command according to your remote machine Note  Above method is used to run the commands on remote server  But if you need to capture the output from remote server we need to create an python code  import subprocess command    C   Python36  python exe C   Python36  Scripts  wmiexec py TargetUser TargetPassword TargetHostname  quot ipconfig quot   command   subprocess Popen command  shell True  stdout subprocess PIPE  stdout  command communicate   0  print  stdout   Modify the code accordingly and run it

User · Answer

I have personally found pywinrm library to be very effective   However  it does require some commands to be run on the machine and some other setup before it will work

User · Answer

You can connect one computer to another computer in a network by using these two methods    Use WMI library  Netuse method      WMI  Here is the example to connect using wmi module   ip    192 168 1 13  username    username  password    password  from socket import   try      print  Establishing connection to  s   ip      connection   wmi WMI ip  user username  password password      print  Connection established   except wmi x wmi      print  Your Username and Password of   getfqdn ip    are wrong        netuse  The second method is to use netuse module   By Netuse  you can connect to remote computer  And you can access all data of the remote computer  It is possible in the following two ways    Connect by virtual connection   import win32api import win32net ip    192 168 1 18  username    ram  password    ram 123   use dict    use dict  remote   unicode      192 168 1 18 C    use dict  password   unicode password  use dict  username   unicode username  win32net NetUseAdd None  2  use dict    To disconnect   import win32api import win32net win32net NetUseDel      192 168 1 18  username win32net USE FORCE   Mount remote computer drive in local system   import win32api import win32net import win32netcon win32wnet  username  user  password  psw   try      win32wnet WNetAddConnection2 win32netcon RESOURCETYPE DISK   Z        192 168 1 18  D    None  username  password  0      print  connection established successfully   except      print  connection not established     To unmount remote computer drive in local system   import win32api import win32net import win32netcon win32wnet  win32wnet WNetCancelConnection2      192 168 1 4  D   1 1        Before using netuse you should have pywin32 install in your system with python also      Source  Connect remote system

User · Answer

Maybe you can use SSH to connect to a remote server   Install freeSSHd on your windows server   SSH Client connection Code   import paramiko  hostname    your-hostname  username    your-username  password    your-password  cmd    your-command   try      ssh   paramiko SSHClient       ssh set missing host key policy paramiko AutoAddPolicy        ssh connect hostname username username password password      print  Connected to  s    hostname  except paramiko AuthenticationException      print  Failed to connect to  s due to wrong username password   hostname      exit 1  except Exception as e      print e message          exit 2    Execution Command and get feedback   try      stdin  stdout  stderr   ssh exec command cmd  except Exception as e      print e message   err      join stderr readlines    out      join stdout readlines    final output   str out  str err  print final output

User · Answer

You can use pywinrm library instead which is cross-platform compatible   Here is a simple code example      usr bin env python import winrm    Create winrm connection  sess   winrm Session  https   10 0 0 1   auth   username    password    transport  kerberos   result   sess run cmd  ipconfig      all      Install library via  pip install pywinrm requests kerberos     Here is another example from this page to run Powershell script on a remote host   import winrm  ps script       strComputer    Host Clear  RAM   WmiObject Win32 ComputerSystem  MB   1048576   Installed Memory       int   RAM TotalPhysicalMemory   MB      MB       s   winrm Session  windows-host example com   auth   john smith    secret    r   s run ps ps script   gt  gt  gt  r status code 0  gt  gt  gt  r std out Installed Memory  3840 MB   gt  gt  gt  r std err

User · Answer

do the client machines have python loaded   if so  I m doing this with psexec  On my local machine  I use subprocess in my  py file to call a command line   import subprocess subprocess call  psexec  server  -c         the -c copies the file to the server so i can run any executable file  which in your case could be a  bat full of connection tests or your  py file from above

User · Answer

is it too late   I personally agree with Beatrice Len  I used paramiko maybe is an extra step for windows  but I have an example project git hub  feel free to clone or ask me   https   github com davcastroruiz django-ssh-monitor

[python] How to connect to a remote Windows machine to execute commands using python?

Examples related to python

Examples related to windows

Examples related to sockets

Examples related to wmi

Examples related to remote-server