# Pywirt | Python Windows Incident Response Toolkit

**URL:** <https://onehack.st/t/pywirt-python-windows-incident-response-toolkit/229306>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [December 3, 2022, 8:37pm UTC](https://onehack.st/t/pywirt-python-windows-incident-response-toolkit/229306 "2022-12-03T20:37:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [December 3, 2022, 8:37pm UTC](https://onehack.st/t/pywirt-python-windows-incident-response-toolkit/229306/1 "2022-12-03T20:37:00Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/1/7/174df78296b72f09a3ccfa93b447d66d36e5e88d.jpeg)

Tested Windows 10

## Description

With this application, it is aimed to accelerate the incident response processes by collecting information in windows operating systems via winrm.

## Features

Information is collected in the following contents.

IP Configuration

Users

Groups

Tasks

Services

Task Scheduler

Registry Control

Active TCP & UDP ports

File sharing

Files

Firewall Config

Sessions with other Systems

Open Sessions

Log Entries

## Installation

```auto
git clone https://github.com/anil-yelken/pywirt

cd pywirt

pip3 install pywinrm

```

## Usage

The following information should be specified in the cred\_list.txt file:

IP|Username|Password

[![](https://github.com/anil-yelken/pywirt/raw/main/cred_list.jpg)](https://github.com/anil-yelken/pywirt/blob/main/cred_list.jpg)

[![](https://github.com/anil-yelken/pywirt/raw/main/pywint.jpg)](https://github.com/anil-yelken/pywirt/blob/main/pywint.jpg)

## Contact

> [https://twitter.com/anilyelken06](https://twitter.com/anilyelken06)
> 
> [https://medium.com/@anilyelken](https://medium.com/@anilyelken)

## GitHub: