arsenal/impacket

impacket

AD protocol toolkit · Apache-2.0

Python tools and classes for working directly with SMB, Kerberos, and MSRPC: secretsdump, psexec, wmiexec, and the Kerberos attacks.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Speaking Windows protocols directly

impacket is a set of Python implementations of the protocols Windows networks run on: SMB, MSRPC, Kerberos, LDAP. On top of them sit a collection of ready-to-run example scripts that are, in practice, the standard toolkit for Active Directory work. They let you authenticate, run commands, pull secrets, and perform the well-known Kerberos attacks from Linux, without a Windows machine. If the AD group has a workhorse, this is it.

↑ contents

02Install

$ pipx install impacket # any distro (PyPI, recommended)

$ sudo apt install impacket-scripts # Debian / Kali

$ sudo dnf install python3-impacket # Fedora

03Running commands on a host

Given valid credentials, several impacket scripts give you command execution on a Windows host, each using a different protocol so you have options when one is blocked or monitored: psexec (a service, noisy but a full SYSTEM shell), wmiexec (over WMI, semi-interactive, quieter), smbexec, and atexec (scheduled task). The credential syntax domain/user:password@host is shared across the suite.

$ impacket-wmiexec CORP/alice:'Summer2026!'@10.0.0.20

$ impacket-psexec CORP/alice:'Summer2026!'@10.0.0.20

04Dumping credentials with secretsdump

secretsdump is the famous one. With the right privileges it extracts password hashes from a host or a whole domain: the local SAM, cached domain credentials, and, against a domain controller, the entire directory via the DCSync technique. Those NTLM hashes feed hashcat, or pass-the-hash directly. On your own lab this demonstrates vividly why domain admin on one DC means the whole domain.

$ impacket-secretsdump CORP/alice:'Summer2026!'@10.0.0.20

$ impacket-secretsdump -just-dc CORP/admin:'Pass!'@10.0.0.10

05Pass-the-hash

Windows authenticates with the NTLM hash, not the plaintext, so a captured hash is often as good as the password: you can authenticate with it directly, no cracking required. impacket takes -hashes in place of a password across the suite. This is why those secretsdump hashes are so valuable and why hash theft is so serious.

$ impacket-wmiexec -hashes :8846f7eaee8fb117ad06bdd830b7586c CORP/Administrator@10.0.0.20

↑ contents

06Kerberoasting

Service accounts in AD can have their service tickets requested by any authenticated user, and those tickets are encrypted with the service account's password hash, which means they can be cracked offline. GetUserSPNs requests them for you. Service accounts often have old, weak passwords, which makes this a reliable path. Crack the output with hashcat mode 13100.

$ impacket-GetUserSPNs CORP/alice:'Summer2026!' -dc-ip 10.0.0.10 -request -outputfile roast.txt

$ hashcat -m 13100 roast.txt rockyou.txt

07AS-REP roasting

Accounts with Kerberos pre-authentication disabled will hand out a crackable blob to anyone who asks, no credentials needed. GetNPUsers finds and requests them. It is a smaller class of accounts but needs no starting credential, so it is a common first move. Crack with hashcat mode 18200.

$ impacket-GetNPUsers CORP/ -dc-ip 10.0.0.10 -usersfile users.txt -no-pass -request

$ hashcat -m 18200 asrep.txt rockyou.txt

↑ contents

08Hardening AD against the impacket playbook

Each impacket technique has a defence, and together they are a strong AD hardening checklist. Walking your own lab through them and then closing each door is one of the best ways to learn Active Directory security.

» secretsdump and DCSync need high privilege; guard domain admin fiercely, monitor DCSync replication from non-DCs, and use the Protected Users group and tiered admin.

» Pass-the-hash thrives on reused local admin passwords; deploy LAPS so every machine has a unique local admin password.

» Kerberoasting falls to strong service-account passwords; use long, random passwords or group managed service accounts (gMSA).

» AS-REP roasting is closed by requiring Kerberos pre-authentication on every account; find and fix the ones that disabled it.

» Log and alert on the patterns: ticket requests in bulk, psexec service creation, secretsdump access to LSASS and NTDS.

↑ contents