E-IMP
impacket
Python library and collection of example scripts implementing Windows/AD network protocols, the base for secretsdump, psexec.py, and dozens of other tools.
OVERVIEW
Impacket (fortra/impacket) is a Python library implementing a large slice of the Windows/AD network protocol stack from scratch — SMB, MSRPC, Kerberos, LDAP, and more — plus dozens of example scripts built on top of it that cover most of a pentester's day-to-day interaction with a Windows network: psexec.py and wmiexec.py for remote command execution, GetUserSPNs.py and GetNPUsers.py for Kerberoasting and AS-REP roasting, ntlmrelayx.py for NTLM relay, secretsdump.py for credential dumping (which has its own entry on this site), and many more.
Because it reimplements the protocols directly in Python rather than shelling out to Windows tooling, it works cross-platform from a Linux attack box with no RDP or native client needed, and it's the library underneath a large share of the AD-focused offensive tooling ecosystem — CrackMapExec/NetExec and BloodHound-adjacent collectors both lean on Impacket-derived protocol handling.
USE CASES
Practical use cases
- 01
Executing commands remotely on a Windows host over SMB/WMI/DCOM with valid credentials (psexec.py, wmiexec.py).
- 02
Requesting Kerberos service tickets or AS-REP responses to crack offline (GetUserSPNs.py, GetNPUsers.py).
- 03
Relaying captured NTLM authentication to another host with SMB signing disabled (ntlmrelayx.py).
- 04
Building custom enumeration or automation scripts against SMB, LDAP, or RPC using the library directly instead of an example script.
QUICK START
Once valid credentials or a foothold exist on a Windows/AD network, to enumerate, authenticate, or execute against hosts using its example scripts instead of a GUI tool.
- Confirm which specific Impacket script(s) and level of access (enumeration vs. execution vs. relay) are authorized for this engagement — the toolkit spans the whole chain, so scope each script's use individually against the rules of engagement.
- Install Impacket (pip install impacket) and confirm the example scripts are on PATH.
- Start with a read-only enumeration script (e.g. lookupsid.py or GetADUsers.py) to validate credentials and access before anything that executes code or writes to the target.
- Move to execution or extraction scripts (psexec.py, secretsdump.py) only once that level of access is explicitly agreed.
- Log which script, target, and credential were used for each action so the report can trace exactly what happened.
GetUserSPNs.py DOMAIN/user:password -dc-ip 10.10.10.10 -requestBEFORE YOU RUN IT
What to check before running it
Impacket is a broad toolkit, not a single tool — each example script (execution, relay, credential dumping) carries its own risk and detection profile, so scope and authorize their use individually rather than treating 'Impacket is in scope' as a blanket approval.
Execution scripts (psexec.py, wmiexec.py) leave forensic artifacts (service creation, named pipes) on the target that a mature blue team will find during review; note which hosts were touched for the report.
Kerberoasting and NTLM relay scripts depend on domain configuration a client may consider sensitive to disclose broadly — handle recovered tickets, hashes, and relay results per the engagement's data-handling rules.