Impacket — Python Network Protocol Library for Security Testing

Introduction

Impacket is a collection of Python classes focused on providing access to network packets and implementations of protocols such as SMB, MSRPC, NTLM, Kerberos, LDAP, and more. It is the de facto standard library for network-level security testing in Python, used extensively in authorized penetration tests and security research.

What Impacket Does

• Implements SMB/CIFS protocol for file sharing operations, share enumeration, and relay attacks
• Provides Kerberos authentication tools including ticket requests, AS-REP roasting, and Kerberoasting
• Includes remote execution methods via PSExec, WMIExec, SMBExec, AtExec, and DCOMExec
• Supports NTLM relay and credential capture through protocol-level manipulation
• Offers LDAP and MSRPC implementations for Active Directory reconnaissance and enumeration

Architecture Overview

Impacket is structured as a Python library with protocol implementations in the core package and example scripts in the examples/ directory. The library provides raw packet crafting capabilities alongside high-level protocol clients. Each protocol (SMB, Kerberos, LDAP, MSRPC) has its own module with both low-level structures and ready-to-use client classes. The example scripts serve as both tools and reference implementations.

Self-Hosting & Configuration

• Requires Python 3.7+ with pip for installation
• Install system dependencies: apt install python3-dev libkrb5-dev for Kerberos support on Debian/Ubuntu
• No configuration files needed; all parameters are passed via command-line arguments
• Virtual environment recommended: python3 -m venv impacket-env && source impacket-env/bin/activate
• Docker images available for isolated usage without system-level Python changes

Key Features

• Over 30 ready-to-use example scripts covering common penetration testing workflows
• Full Kerberos implementation supporting authentication, ticket manipulation, and delegation attacks
• Multiple remote code execution methods that work across different Windows service configurations
• Active Directory certificate services (ADCS) attack tools for ESC1-ESC8 vectors
• Maintained by Fortra (formerly Core Security) with regular updates for new attack techniques

Comparison with Similar Tools

• CrackMapExec/NetExec — higher-level tool that uses Impacket under the hood; easier for quick enumeration but less flexible
• Rubeus — C# Kerberos toolkit for Windows; Impacket provides equivalent functionality from Linux
• PowerView — PowerShell-based AD enumeration; Impacket achieves similar results over the network without needing a domain-joined host
• Coercer — focuses specifically on authentication coercion; Impacket covers coercion plus execution, relay, and enumeration

FAQ

Q: Is Impacket only for offensive security? A: While primarily used in penetration testing, Impacket is also valuable for network debugging, protocol research, and building security detection rules by understanding protocol behavior.

Q: Does Impacket require domain credentials? A: Many tools work with various authentication levels. Some enumeration works with null sessions, while execution tools typically need valid credentials obtained during an authorized engagement.

Q: What Python version does Impacket require? A: Impacket requires Python 3.7 or later. Python 2 support was dropped in recent versions.

Q: How does Impacket compare to Metasploit for Windows attacks? A: Impacket provides more granular protocol-level control and is lighter weight, while Metasploit offers a broader exploit framework with post-exploitation modules.

Sources

• https://github.com/fortra/impacket
• https://www.secureauth.com/labs/open-source-tools/impacket/