Examples & Tools Overview

Comprehensive collection of network protocol tools and security examples

Impacket includes a powerful collection of example scripts and tools for working with network protocols, particularly focused on Windows network security testing and research.

Tool Categories

The examples are organized into functional categories:

Remote Execution

Execute commands on remote systems via various protocols

Credential Dumping

Extract credentials from remote and local systems

Kerberos Attacks

Kerberoasting, AS-REP roasting, and ticket manipulation

LDAP Operations

Active Directory enumeration and manipulation

SMB Operations

File sharing, registry access, and SMB enumeration

Common Authentication Options

Most tools support multiple authentication methods:

Password

tool.py DOMAIN/username:password@target

NTLM Hash

tool.py DOMAIN/username@target -hashes LMHASH:NTHASH
# Pass-the-Hash (empty LM hash)
tool.py DOMAIN/username@target -hashes :NTHASH

Kerberos

# Using password
tool.py DOMAIN/username:password@target -k -dc-ip DC_IP

# Using ticket cache (KRB5CCNAME)
export KRB5CCNAME=/path/to/ticket.ccache
tool.py DOMAIN/username@target -k -no-pass

AES Key

tool.py DOMAIN/username@target -aesKey AES256_KEY -k -dc-ip DC_IP

Installation & Usage

After installing Impacket, all example scripts are available as command-line tools:

# Install Impacket
pip install impacket

# Or from source
git clone https://github.com/fortra/impacket
cd impacket
pip install .

# Run examples
psexec.py --help
secretsdump.py --help

Quick Reference

Remote Execution Tools

Tool	Protocol	Execution Context	Stealth
psexec.py	SMB + Service Control	SYSTEM	Low (Event logs)
smbexec.py	SMB + Service Control	SYSTEM	Low (Event logs)
wmiexec.py	DCOM/WMI	Admin user	Medium
dcomexec.py	DCOM Objects	Admin user	Medium
atexec.py	Task Scheduler	SYSTEM	Medium

Credential Dumping Tools

Tool	Target	Method	Requires
secretsdump.py	SAM, NTDS, LSA	Remote registry/DCSync	Admin/DC Replication
Get-GPPPassword.py	GPP passwords	SYSVOL parsing	Domain user
GetLAPSPassword.py	LAPS passwords	LDAP queries	Delegated permissions

Kerberos Attack Tools

Tool	Attack Type	Output Format	Usage
GetUserSPNs.py	Kerberoasting	JtR/Hashcat	Request TGS for cracking
GetNPUsers.py	AS-REP Roasting	JtR/Hashcat	Find users without pre-auth
ticketer.py	Golden/Silver Ticket	.ccache	Forge Kerberos tickets
getTGT.py	TGT Request	.ccache	Request TGT with credentials

Output Formats

Many tools support multiple output formats:

John the Ripper

GetUserSPNs.py -request domain/user:pass@dc -outputfile hashes.txt
john --wordlist=rockyou.txt hashes.txt

Common Parameters

-debug

Enable verbose debug output to troubleshoot connection issues

-dc-ip

Specify Domain Controller IP address (required for Kerberos)

-target-ip

Target machine IP when using NetBIOS names

-port

Specify custom port (default: 445 for SMB, 88 for Kerberos)

-k

Use Kerberos authentication instead of NTLM

-no-pass

Don’t prompt for password (use with -k and KRB5CCNAME)

-ts

Add timestamps to logging output

Security Considerations

These tools are designed for authorized security testing and research only. Unauthorized access to computer systems is illegal.

Best Practices

• Always obtain proper authorization before testing
• Use dedicated test environments when learning
• Monitor for detection - understand what logs are generated
• Use encrypted channels when possible (Kerberos, LDAPS)
• Clean up artifacts - remove created accounts, services, files

Troubleshooting

Connection Issues

# Test SMB connectivity
smbclient.py domain/user@target

# Check with debug output
tool.py domain/user@target -debug

# Verify port access
nc -zv target 445
nc -zv target 135  # For WMI/DCOM

Kerberos Errors

# Clock skew issues
sudo ntpdate dc-ip

# KDC unreachable
# Ensure -dc-ip points to DC
tool.py domain/user@target -k -dc-ip DC_IP

# Check ticket cache
klist
export KRB5CCNAME=/path/to/ticket.ccache

Authentication Failures

# Verify credentials
crackmapexec smb target -u user -p password

# Test with different auth methods
tool.py -hashes :NTHASH  # Pass-the-hash
tool.py -k -no-pass      # Kerberos ticket
tool.py -aesKey KEY -k   # AES key

Next Steps

Remote Execution

Learn how to execute commands remotely

Credential Dumping

Extract and dump credentials

Kerberos Attacks

Perform Kerberos-based attacks

API Reference

Use Impacket in your own tools