Impacket: The Windows Network Attack Toolkit

Impacket is a collection of Python tools for talking to Windows network protocols at a low level , and, in the hands of a tester or an attacker, for abusing them. It is not a single program but a toolkit of scripts, each automating a specific technique against Active Directory and Windows services. If NetExec is the Swiss-army knife of internal testing, Impacket is the drawer of precision instruments underneath it, and much of the tooling in this space is built on top of it.

Here is what it does and, if its scripts appear in a report against your environment, what each one is telling you.

What it actually is

Impacket implements the Windows network protocols , SMB, MSRPC, Kerberos, LDAP, NTLM , directly in Python, so a tester can speak them precisely rather than relying on Windows to do it for them. That low-level control is what enables the attacks: when you control the protocol, you can use it in ways the designers assumed only trusted systems would.

It is delivered as a set of named scripts, and the script names show up in engagement reports. Knowing what each one does tells you exactly what technique was used against you.

The scripts that matter, and what they mean

• secretsdump.py , extracts password hashes and secrets from a system or domain: local SAM hashes, cached credentials, and , with the right access , the entire Active Directory password database (NTDS.dit). If this appears in a report, an attacker reached a position to dump credentials at scale. It is one of the most serious findings on this list.
• psexec.py / smbexec.py / wmiexec.py / atexec.py , remote command execution on Windows hosts using different built-in mechanisms (Windows services, SMB, WMI, scheduled tasks). Their presence means a valid credential was turned into code execution on a target. The variety exists so a tester can choose the method least likely to be blocked or logged.
• GetUserSPNs.py , performs Kerberoasting: requests service tickets whose encryption can be cracked offline to recover service-account passwords. A finding here means service accounts with weak passwords are exposed.
• GetNPUsers.py , performs AS-REP roasting: targets accounts with Kerberos pre-authentication disabled, whose hashes can be requested and cracked offline. A specific misconfiguration with a specific fix.
• ntlmrelayx.py , automates NTLM relay attacks: captures authentication and relays it to another system to act as the victim. This is why SMB signing and channel binding matter; a finding here means they were missing.
• ticketer.py / getST.py , forge and manipulate Kerberos tickets (Golden and Silver ticket techniques), typically demonstrating persistence after a significant compromise.

What its use reveals about your network

Every Impacket finding points at a concrete, fixable weakness:

• secretsdump succeeded , an account reached a domain controller or a host with cached high-value credentials. Investigate privilege and tiering.
• Command-execution scripts worked , a credential had remote-execution rights across hosts. Tighten local admin rights and use LAPS.
• Kerberoasting or AS-REP roasting returned crackable hashes , service and user accounts use weak passwords, or pre-authentication is disabled. Strong passwords for service accounts and managed service accounts fix this.
• ntlmrelayx worked , SMB signing was not enforced. Enable it.

None of these are software vulnerabilities in the patch-me sense. They are the structural weaknesses of a real Active Directory environment , exactly what an internal test exists to find.

How defenders detect it

Impacket’s techniques are noisy if you are watching the right telemetry:

• secretsdump generates recognisable access to LSASS, the SAM, or a domain controller’s NTDS , high-fidelity alerts when monitored.
• The execution scripts create services, scheduled tasks, or WMI processes with detectable signatures (Windows Event IDs 7045, 4698, and process-creation logs).
• Kerberoasting shows as service-ticket requests (Event ID 4769) for many service accounts in a short window.
• NTLM relay is mitigated structurally by enforcing SMB signing and LDAP channel binding, which is better than detecting it after the fact.

Detecting Impacket activity , or failing to , is itself a finding. If these scripts ran across your domain and nothing alerted, your detection has a gap as important as any vulnerability.

Where it fits in an engagement

Impacket is a core toolkit of the post-exploitation and lateral-movement phases in internal network penetration testing and red team assessments. It works alongside tools like NetExec (which itself uses Impacket under the hood) to turn a foothold into domain-wide compromise, one protocol abuse at a time.

The short version

Impacket is the toolkit that abuses Windows network protocols at a low level, delivered as named scripts , secretsdump, psexec, GetUserSPNs, ntlmrelayx , each automating a specific Active Directory attack. When one appears in a report, it names the exact technique used and the exact weakness behind it: dumpable credentials, weak service-account passwords, missing SMB signing, excessive rights. The fixes are the fundamentals of AD security, and whether your monitoring caught any of it is a finding in its own right.

Want to know how far these techniques would get inside your Active Directory , and whether anything would notice? That is what an internal network penetration test measures. Scope one here.