Impacket Scripts

Impacket-scripts is a Kali Linux package containing symbolic links to useful Impacket scripts, separating them from the main Debian impacket package for easy access in the PATH. These scripts implement various Windows network protocols including SMB, MSRPC, Kerberos, LDAP, and more, enabling penetration testers to interact with Windows systems for enumeration, exploitation, and post-exploitation activities.

The package supports a wide range of operations such as NTLM authentication parsing, Group Policy password extraction, Active Directory enumeration, Kerberos ticket manipulation, remote command execution, service management, and privilege escalation techniques. Scripts target domain controllers, workstations, and servers across different protocols and authentication mechanisms.

Use cases include Active Directory reconnaissance (GetADUsers, GetADComputers), Kerberos attacks (GetUserSPNs, GetNPUsers), SMB execution (psexec, smbexec), credential dumping (ntlmrelayx), and advanced persistence techniques like WMI event subscriptions and RBCD attacks.

Scripts implement Windows network protocols using pure Python: SMB for file/service operations, MSRPC/DCOM for remote execution, Kerberos for ticket-based auth, LDAP for directory queries, and NTLM for challenge-response auth. They support multiple authentication methods (passwords, NTLM hashes, Kerberos tickets, AES keys) and connect via TCP ports (445/SMB, 135/RPC, 389/LDAP, 88/Kerberos). Many leverage Impacket's protocol libraries to parse structures, forge packets, and relay authentication for attacks like Kerberoasting, AS-REP roasting, and NTLM relay.