Impacket
Impacket is a collection of Python classes for working with network protocols. It provides tools for remote execution, authentication, credential extraction, and protocol interaction that form the backbone of many offensive operations against Windows environments.
Strategic context
Windows networks rely on core protocols (SMB, MSRPC, Kerberos, LDAP, MSSQL) that govern how systems authenticate, share resources, and execute commands. Impacket implements these protocols from scratch, giving operators direct control over how they interact with Windows services without needing a domain-joined Windows machine.
This matters because most offensive operations against Windows environments require interacting with these protocols. Whether the task is executing commands on a remote host, extracting credentials from a domain controller, relaying authentication, or requesting Kerberos tickets, Impacket provides a tool for it. The suite runs on Linux, which means operators can conduct the majority of their Windows-targeted operations from their attack platform without switching between operating systems.
Impacket's individual tools are purpose-built for specific tasks. Rather than being a single monolithic application, it is a toolkit where each script addresses a well-defined need. Understanding which tool applies to which situation, and what each tool does at the protocol level, allows operators to select the right approach for the engagement's requirements.
For security leaders, Impacket usage represents some of the most impactful actions an attacker takes against Windows infrastructure. Detection strategies should focus on the protocol-level behaviors these tools produce: remote service creation, DCOM-based execution, unusual Kerberos ticket requests, and credential extraction patterns. The tools themselves are not the indicator. the protocol behaviors they generate are.
Execution examples
Remote execution
Impacket provides multiple remote execution tools, each using a different protocol and leaving a different forensic footprint.
PsExec creates a service on the remote host and communicates through named pipes. It is reliable but generates artifacts. a file written to disk and a service creation event:
psexec.py domain/user:password@TARGET
psexec.py domain/user@TARGET -hashes LMHASH:NTHASHWMIExec uses Windows Management Instrumentation to execute commands. It does not create services or write binaries to disk, making it generally quieter:
wmiexec.py domain/user:password@TARGET
wmiexec.py domain/user@TARGET -hashes LMHASH:NTHASHSMBExec creates a temporary service that writes command output to a share, avoiding the binary drop that PsExec requires:
ATExec uses the Windows Task Scheduler for execution, which can blend with legitimate scheduled task activity:
DCOMExec uses Distributed COM objects for remote execution:
The choice between these tools depends on the engagement's stealth requirements and what protocols and ports are available on the target.
Credential extraction
SecretsDump extracts credentials from a target system. Against a domain controller, it performs DCSync to retrieve all domain hashes without executing code on the DC itself:
The -just-dc flag limits extraction to domain credentials. The -just-dc-ntlm flag further restricts to NTLM hashes only, excluding Kerberos keys and cleartext passwords from the output.
Kerberos operations
GetUserSPNs requests service tickets for accounts with Service Principal Names set, enabling offline cracking of service account passwords (Kerberoasting):
GetNPUsers identifies and requests AS-REP responses for accounts that do not require Kerberos pre-authentication:
GetTGT and GetST request Kerberos tickets for use in subsequent authentication:
Authentication relaying
NTLMRelayX captures NTLM authentication and relays it to target services, enabling authentication without knowing the password or hash:
Relaying to LDAP on a domain controller can modify domain objects, including granting DCSync rights. Relaying to SMB can achieve remote code execution.
Where Impacket fits in the lifecycle
Reconnaissance: GetUserSPNs and GetNPUsers identify attack candidates; LDAP queries map domain structure
Initial access: NTLMRelayX converts captured authentication into system access
Privilege escalation: SecretsDump extracts credentials; Kerberos tools enable ticket-based attacks
Lateral movement: PsExec, WMIExec, SMBExec, ATExec, and DCOMExec provide remote execution across different protocols
Actions on objective: SecretsDump with DCSync shows full domain compromise
Last updated