> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/smb-cifs/impacket-tools.md).

# Impacket-Tools

Impacket is a collection of Python scripts for working with network protocols. It includes tools useful for post-exploitation, enumeration, remote command execution, and credential dumping in Windows environments.

***

### Installation

```bash
git clone https://github.com/fortra/impacket.git
cd impacket
pip install .
```

***

### impacket-atexec

Executes commands remotely using Windows Task Scheduler (AT service).

Examples:

* Run `ipconfig` on remote host:

  ```bash
  impacket-atexec 'DOMAIN/user:password@target-ip' ipconfig
  ```
* Run `whoami` using hash authentication:

  ```bash
  impacket-atexec -hashes :aad3b435b51404eeaad3b435b51404ee:cc36cf7a8514893efccd332446158b1a 'DOMAIN/user@target-ip' whoami
  ```

***

### impacket-dcomexec

Executes commands via Distributed Component Object Model (DCOM) on Windows systems.

Examples:

* Execute `cmd.exe` interactively:

  ```bash
  impacket-dcomexec 'admin:pass@target-ip'
  ```
* Run a specific command:

  ```bash
  impacket-dcomexec 'admin@target-ip' 'ipconfig /all'
  ```

***

### impacket-psexec

Remote command execution via SMB, similar to Sysinternals PsExec.

Examples:

* Basic usage with username/password:

  ```bash
  impacket-psexec 'admin:password@target-ip'
  ```
* Execute a specific command:

  ```bash
  impacket-psexec 'admin@target-ip'  'whoami'
  ```
* Use NTLM hashes:

  ```bash
  impacket-psexec -hashes :<NTLM_HASH> 'admin@target-ip'
  ```

***

### impacket-smbexec

Executes commands by creating a service and redirecting output via SMB.

Examples:

* Remote shell:

  ```bash
  impacket-smbexec 'admin:password@target-ip'
  ```
* Run a single command:

  ```bash
  impacket-smbexec 'admin@target-ip'  'net users'
  ```

***

### impacket-wmiexec

Executes commands via Windows Management Instrumentation (WMI).

Examples:

* Command execution:

  ```bash
  impacket-wmiexec 'admin:password@target-ip'
  ```
* Run with NTLM hash:

  ```bash
  impacket-wmiexec -hashes :<NTLM_HASH> 'admin@target-ip'
  ```
* Execute with output redirection:

  ```bash
  impacket-wmiexec 'admin@target-ip'  'dir C:\\'
  ```

***

### winexe

Alternative to Impacket for SMB-based remote shell access.

Examples:

* Run command on remote Windows system:

  ```bash
  winexe -U 'Administrator%password' //target-ip 'cmd.exe'
  ```

***

### impacket-rpcdump

Dumps information from RPC endpoints on the target machine.

Examples:

* Dump all endpoints:

  ```bash
  impacket-rpcdump target-ip
  ```
* With authentication:

  ```bash
  impacket-rpcdump 'admin:password@target-ip'
  ```

***

### impacket-getArch

Determines remote OS architecture.

Examples:

* Query remote architecture:

  ```bash
  impacket-getArch 'admin:password@target-ip'
  ```

***

### impacket-lookupsid

Enumerates domain SIDs and usernames.

Examples:

* Lookup all users:

  ```bash
  impacket-lookupsid 'domain/user:password@target-ip'
  ```
* With hashes:

  ```bash
  impacket-lookupsid -hashes :<NTLM_HASH> 'user@target-ip'
  ```

***

### impacket-mimikatz

Executes `mimikatz` on a remote system (requires proper access).

Examples:

* Dump credentials from LSASS remotely:

  ```bash
  impacket-mimikatz 'admin:password@target-ip'
  ```

***

### impacket-reg

Interacts with the Windows registry remotely.

Examples:

* Query registry key:

  ```bash
  impacket-reg query -keyName 'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -target-ip 'admin:password@target-ip'
  ```

***

### impacket-samrdump

Dumps info via the Security Account Manager (SAMR) protocol.

Examples:

* Dump user info:

  ```bash
  impacket-samrdump 'admin:password@target-ip'
  ```

***

### impacket-secretsdump

Dumps hashes from SAM, LSA, and NTDS.

Examples:

* Dump local hashes from a machine:

  ```bash
  impacket-secretsdump 'admin:password@target-ip'
  ```
* Use with NTDS.dit and SYSTEM hive:

  ```bash
  impacket-secretsdump -system SYSTEM -ntds NTDS.dit LOCAL
  ```

***

### impacket-services

Enumerate and manipulate Windows services.

Examples:

* List services:

  ```bash
  impacket-services 'admin:password@target-ip' list
  ```
* Start a service:

  ```bash
  impacket-services 'admin@target-ip' start Spooler
  ```
* Stop a service:

  ```bash
  impacket-services 'admin@target-ip' stop Spooler
  ```