Examples & Tools Overview

Impacket includes a powerful collection of example scripts and tools for working with network protocols, particularly focused on Windows network security testing and research.

Tool Categories

The examples are organized into functional categories:

Remote Execution

Execute commands on remote systems via various protocols

Credential Dumping

Extract credentials from remote and local systems

Kerberos Attacks

Kerberoasting, AS-REP roasting, and ticket manipulation

LDAP Operations

Active Directory enumeration and manipulation

SMB Operations

File sharing, registry access, and SMB enumeration

Common Authentication Options

Most tools support multiple authentication methods:

Password
NTLM Hash
Kerberos
AES Key

tool.py DOMAIN/username:password@target

tool.py DOMAIN/username@target -hashes LMHASH:NTHASH
# Pass-the-Hash (empty LM hash)
tool.py DOMAIN/username@target -hashes :NTHASH

# Using password
tool.py DOMAIN/username:password@target -k -dc-ip DC_IP

# Using ticket cache (KRB5CCNAME)
export KRB5CCNAME=/path/to/ticket.ccache
tool.py DOMAIN/username@target -k -no-pass

tool.py DOMAIN/username@target -aesKey AES256_KEY -k -dc-ip DC_IP

Installation & Usage

After installing Impacket, all example scripts are available as command-line tools:

# Install Impacket
pip install impacket

# Or from source
git clone https://github.com/fortra/impacket
cd impacket
pip install .

# Run examples
psexec.py --help
secretsdump.py --help

Quick Reference

Remote Execution Tools

Tool	Protocol	Execution Context	Stealth
psexec.py	SMB + Service Control	SYSTEM	Low (Event logs)
smbexec.py	SMB + Service Control	SYSTEM	Low (Event logs)
wmiexec.py	DCOM/WMI	Admin user	Medium
dcomexec.py	DCOM Objects	Admin user	Medium
atexec.py	Task Scheduler	SYSTEM	Medium

Credential Dumping Tools

Tool	Target	Method	Requires
secretsdump.py	SAM, NTDS, LSA	Remote registry/DCSync	Admin/DC Replication
Get-GPPPassword.py	GPP passwords	SYSVOL parsing	Domain user
GetLAPSPassword.py	LAPS passwords	LDAP queries	Delegated permissions

Kerberos Attack Tools

Tool	Attack Type	Output Format	Usage
GetUserSPNs.py	Kerberoasting	JtR/Hashcat	Request TGS for cracking
GetNPUsers.py	AS-REP Roasting	JtR/Hashcat	Find users without pre-auth
ticketer.py	Golden/Silver Ticket	.ccache	Forge Kerberos tickets
getTGT.py	TGT Request	.ccache	Request TGT with credentials

Output Formats

Many tools support multiple output formats:

GetUserSPNs.py -request domain/user:pass@dc -outputfile hashes.txt
john --wordlist=rockyou.txt hashes.txt

Common Parameters

-debug

Enable verbose debug output to troubleshoot connection issues

-dc-ip

Specify Domain Controller IP address (required for Kerberos)

-target-ip

Target machine IP when using NetBIOS names

-port

Specify custom port (default: 445 for SMB, 88 for Kerberos)

-k

Use Kerberos authentication instead of NTLM

-no-pass

Don’t prompt for password (use with -k and KRB5CCNAME)

-ts

Add timestamps to logging output

Security Considerations

These tools are designed for authorized security testing and research only. Unauthorized access to computer systems is illegal.

Best Practices

Always obtain proper authorization before testing
Use dedicated test environments when learning
Monitor for detection - understand what logs are generated
Use encrypted channels when possible (Kerberos, LDAPS)
Clean up artifacts - remove created accounts, services, files

Troubleshooting

Connection Issues
Kerberos Errors
Authentication Failures

# Test SMB connectivity
smbclient.py domain/user@target

# Check with debug output
tool.py domain/user@target -debug

# Verify port access
nc -zv target 445
nc -zv target 135  # For WMI/DCOM

# Clock skew issues
sudo ntpdate dc-ip

# KDC unreachable
# Ensure -dc-ip points to DC
tool.py domain/user@target -k -dc-ip DC_IP

# Check ticket cache
klist
export KRB5CCNAME=/path/to/ticket.ccache

# Verify credentials
crackmapexec smb target -u user -p password

# Test with different auth methods
tool.py -hashes :NTHASH  # Pass-the-hash
tool.py -k -no-pass      # Kerberos ticket
tool.py -aesKey KEY -k   # AES key

Next Steps

Remote Execution

Learn how to execute commands remotely

Credential Dumping

Extract and dump credentials

Kerberos Attacks

Perform Kerberos-based attacks

API Reference

Use Impacket in your own tools

Get Started

Core Protocols

Authentication

Examples & Tools

Advanced Topics

Examples & Tools Overview

Tool Categories

Remote Execution

Credential Dumping

Kerberos Attacks

LDAP Operations

SMB Operations

Common Authentication Options

Installation & Usage

Quick Reference

Remote Execution Tools

Credential Dumping Tools

Kerberos Attack Tools

Output Formats

Common Parameters

Security Considerations

Best Practices

Troubleshooting

Next Steps

Remote Execution

Credential Dumping

Kerberos Attacks

API Reference

Build docs developers (and LLMs) love

Get Started

Core Protocols

Authentication

Examples & Tools

Advanced Topics

​Tool Categories

Remote Execution

Credential Dumping

Kerberos Attacks

LDAP Operations

SMB Operations

​Common Authentication Options

​Installation & Usage

​Quick Reference

​Remote Execution Tools

​Credential Dumping Tools

​Kerberos Attack Tools

​Output Formats

​Common Parameters

​Security Considerations

​Best Practices

​Troubleshooting

​Next Steps

Remote Execution

Credential Dumping

Kerberos Attacks

API Reference

Build docs developers (and LLMs) love

Tool Categories

Common Authentication Options

Installation & Usage

Quick Reference

Remote Execution Tools

Credential Dumping Tools

Kerberos Attack Tools

Output Formats

Common Parameters

Security Considerations

Best Practices

Troubleshooting

Next Steps