The Impacket toolkit: what each script actually does

In October 2022, the U.S. Cybersecurity and Infrastructure Security Agency published an advisory about a defense contractor whose network had been sitting in enemy hands for the better part of a year. Multiple state-sponsored hacking groups had wandered its systems from at least November 2021 through January 2022, quietly reading email and stealing contract data. When investigators reconstructed how the intruders moved from machine to machine, they kept finding the fingerprints of two small Python scripts: wmiexec.py and smbexec.py. Both ship inside a free, open-source toolkit called Impacket that anyone can install with a single pip command.

That is the strange thing about Impacket. It is not malware. It is not an exploit kit sold on a forum. It is a respectable, decade-plus-old software library that penetration testers, corporate red teams, and university researchers use every day, and it is also one of the most reliably abused pieces of code in modern network intrusions. MITRE's ATT&CK knowledge base links it to at least nineteen named threat groups, including APT29, APT41, HAFNIUM, and Volt Typhoon. Understanding what its scripts actually do is one of the clearest windows there is into how attacks on Windows networks really work.

The library underneath the toolkit

Strip away the reputation and Impacket is, in its maintainers' words, "a collection of Python classes for working with network protocols." That sounds dry, and the core of it genuinely is: code that can build a network packet byte by byte, or take raw bytes off the wire and parse them into something a program can reason about. What makes it powerful is which protocols it implements, and how completely. Most networking libraries stop at the plumbing: TCP, UDP, IP. Impacket goes up the stack into the protocols that actually run a corporate Windows environment. It contains working implementations of SMB versions 1 through 3 (the file-sharing protocol behind every \\server\share path), of MSRPC, the remote procedure call system Windows uses to let one machine ask another to do things, and of the authentication schemes that guard them: NTLM and Kerberos. On top of MSRPC it implements dozens of specific interfaces by their Microsoft specification names, among them SAMR (the account manager), SCMR (the service control manager), TSCH (the task scheduler), DRSUAPI (directory replication), and WMI (Windows Management Instrumentation). Each of those is a lever that a normal Windows admin tool pulls. Impacket lets you pull them from a Python script on a Linux laptop. The project began inside SecureAuth's Core Security research group and was maintained for most of its life by the developer Alberto Solino, whose handle appears throughout the commit history. In 2022 it moved to the security company Fortra, which had acquired Core Security's parent; the code's home on GitHub shifted from SecureAuthCorp/impacket to fortra/impacket, which is why older tutorials point at a repository that now redirects. It is released under a lightly modified Apache license, and the current stable version, 0.13.1, runs on Python 3.9 through 3.13. Crucially, the library ships with a folder of examples, and it is those example scripts, not the classes themselves, that made Impacket famous. They were written to demonstrate the library's capabilities. They turned out to be complete, dependable intrusion tools. Everything that follows is about those scripts, but keep the distinction in mind: almost none of them exploit a vulnerability. They abuse features that Windows offers on purpose, to anyone who already holds valid credentials.

Getting a shell: the -exec family

The single most-used group of scripts answers one question: I have a username and password (or a stolen password hash) for a Windows machine. How do I run commands on it from across the network? Windows offers several legitimate mechanisms for exactly this, because administrators need to manage machines remotely. Impacket provides a script for each, and the differences between them are a short course in operational tradecraft. psexec.py is the loudest and the most reliable. It reimplements Microsoft's own Sysinternals PsExec utility. When you run it, it copies a small service executable (historically one called RemComSvc) onto the target's hidden ADMIN$ share, then uses the service control manager to register that executable as a new Windows service and start it. The service opens a channel back to you, and you get a fully interactive command prompt running as NT AUTHORITY\SYSTEM, the highest local privilege. The cost is noise: it writes a binary to disk and it creates a service, and service creation generates a Windows event (ID 7045) that any competent monitoring setup flags. smbexec.py trims some of that noise. It also creates a service, but it does not drop a dedicated binary; instead the service it registers simply runs cmd.exe with your command, writing the output to a file that Impacket then reads back over SMB and deletes. You still get SYSTEM-level execution, but with a lighter on-disk footprint. The tradeoff, as one practitioner's comparison puts it, is that it creates and deletes a service for each command rather than once per session. wmiexec.py avoids services entirely. It uses Windows Management Instrumentation, the same subsystem administrators query for inventory and health data, to spawn processes on the target. Each command runs, its output lands in a temporary file on the ADMIN$ share, and Impacket reads and deletes it, giving you a semi-interactive shell: it feels like a prompt, but each line is a fresh, independent execution rather than a persistent session. Because no service is installed, there is no 7045 event, which is exactly why the CISA-documented intruders reached for it. One subtlety worth knowing: wmiexec.py runs your commands as the authenticated administrator account, not as SYSTEM, which occasionally matters for what you can touch. atexec.py does the same job through the Task Scheduler. It registers a scheduled task that runs your command as SYSTEM, captures the output, then deletes the task. It does not give you a shell at all; it is built for firing single commands and reading the result. dcomexec.py rounds out the family by abusing DCOM, the distributed object system, invoking methods on objects such as MMC20.Application to achieve execution through yet another endpoint that defenders may not be watching as closely. The pattern is the same underneath all five: authenticate, use a by-design remote-management feature to run code, retrieve the output, clean up. A rough rule of thumb among testers is to use psexec or smbexec when you need SYSTEM or want to drop tooling, and wmiexec or atexec for quick, quieter commands.

Emptying the vault: secretsdump

Running commands is only half the game. The other half is credentials, because in a Windows domain the fastest way to the next machine is almost never an exploit. It is a password or, more precisely, a password hash that Windows will happily accept in the password's place, an old design weakness known as "pass-the-hash." The script that harvests those is secretsdump.py, and it is a small masterpiece of doing damage without leaving a mess.

Against a single machine, secretsdump.py reaches into the registry over the remote registry service, pulls the SAM database (local account hashes) and the LSA secrets (cached domain credentials, service account passwords), and reconstructs the hashes offline. But its headline capability targets the crown jewels: the NTDS.dit file on a domain controller, the single database that holds the password hash of every account in the entire domain. You might expect it to copy that file. It does something far more elegant. It performs a DCSync. Domain controllers keep themselves in sync by replicating changes to one another over an interface called DRSUAPI, using a method named DRSGetNCChanges. secretsdump.py simply pretends to be a domain controller and politely asks a real one to replicate the account secrets to it. As The Hacker Recipes describes it, "a DCSync is not a simple copy and parse of the NTDS.dit file"; it is a legitimate replication request that returns hashes, Kerberos keys, and any plaintext passwords stored with reversible encryption. No file is touched, no malware runs on the controller, and to the controller it looks like ordinary replication traffic. The catch is permissions. DCSync requires the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights, which by default belong to Domain Admins, Enterprise Admins, and the domain controllers themselves. The danger in practice is that these rights can be quietly delegated to ordinary accounts through misconfigured permissions, turning a low-value user into a domain-wide skeleton key. MITRE notes that APT41 used Impacket to dump LSA secrets on a domain controller in exactly this vein.

Forging trust: the Kerberos scripts

If secretsdump.py breaks into the vault, a cluster of Impacket scripts attacks the locks themselves, specifically Kerberos, the ticket-based protocol that authenticates users across a modern Windows domain. Kerberos was designed to be robust, but several of its features can be turned against it, and Impacket has a script for each.

GetUserSPNs.py performs Kerberoasting. In Kerberos, a service (a database, a web app) is identified by a Service Principal Name, and any authenticated user can request a ticket to reach one. That ticket is encrypted with a key derived from the service account's password. So the attack is: ask for tickets to every account that has an SPN, then take the encrypted tickets away and try to crack them offline, at leisure, on a fast machine. It requires valid domain credentials but nothing privileged, and it is devastating because service accounts often have old, weak, never-rotated passwords. GetNPUsers.py performs the related AS-REP roasting, and its prerequisite is even lower. Kerberos normally demands "pre-authentication," a step that proves you know the password before it hands you anything crackable. But some accounts have pre-authentication disabled, sometimes for compatibility with legacy systems. For those accounts, GetNPUsers.py can request an authentication response that contains crackable material without any credentials at all, then crack it offline. It is often the very first thing tried against a domain where the attacker knows nothing yet. Once an attacker holds the right hash, the forgery scripts take over. ticketer.py builds counterfeit tickets. Given the hash of the domain's master krbtgt account and the domain's identifier, it mints a golden ticket: a valid ticket-granting ticket for any user, including a fabricated administrator, that the domain will accept as genuine. getTGT.py and getST.py request legitimate ticket-granting tickets and service tickets and save them to disk in the standard ccache format, which enables pass-the-ticket and overpass-the-hash: pointing the KRB5CCNAME environment variable at a saved ticket lets every other Impacket script authenticate as that identity without ever knowing the password.

The man in the middle: ntlmrelayx

The scripts so far assume you already hold a credential. ntlmrelayx.py is the tool for when you do not, and it is arguably the most dangerous thing in the box because it steals authentication in transit and spends it immediately. The mechanism exploits an old weakness in NTLM, the challenge-response scheme that predates Kerberos and still lingers everywhere. When a Windows machine authenticates to a server, it proves it knows a password without sending it. ntlmrelayx.py stands in the middle: it runs SMB and HTTP/HTTPS listeners, and when a victim machine authenticates to it, often after being tricked into doing so by a name-resolution poisoning tool like Responder, it does not try to crack anything. It simply forwards the victim's authentication, live, to a different target server, ending up authenticated there as the victim. The victim never typed a password to the attacker, and the attacker never learned one. The reason this works is that many services do not require signing, a cryptographic check that would tie the authentication to the specific connection and break the relay. What makes the tool genuinely alarming is what it does after a successful relay: automatically dumping the target's SAM, creating a new computer account, configuring resource-based constrained delegation, or requesting a certificate from Active Directory Certificate Services, each of which can be parlayed into durable, privileged control of the domain. It is a single command that turns one careless connection into a foothold.

The supporting cast

Around these headliners sits a wider bench of scripts for reconnaissance and access. lookupsid.py enumerates domain accounts by brute-forcing security identifiers. GetADUsers.py, samrdump.py, rpcdump.py, and netview.py map out users, services, and sessions. mssqlclient.py connects to Microsoft SQL Server and, where permitted, uses its xp_cmdshell feature to run operating-system commands, a lateral-movement path all its own. smbclient.py is an interactive file-share client, and smbserver.py spins up an SMB server in seconds, handy for catching files or hashes. ticketConverter.py and describeTicket.py translate and inspect Kerberos tickets between formats. None of these are exotic; together they let an operator live inside a Windows network using nothing but Python.

Why defenders can't simply block it

Here is the misconception worth confronting directly: that Impacket is a "hacking tool" and the fix is to ban it. It is not, in any meaningful sense, exploiting bugs. Every technique above rides on a feature Microsoft built deliberately, remote service control, WMI, task scheduling, directory replication, Kerberos ticketing, and every one requires the attacker to already possess a valid credential or a relayable authentication. Impacket is dangerous precisely because its traffic can look like legitimate administration. That dual-use nature is the whole point: the same secretsdump.py a red team runs on Tuesday is the one an intruder runs on Wednesday, and it is the plumbing beneath widely used security tools like NetExec (formerly CrackMapExec). Defenders can, however, watch for its habits. Historically the example scripts left telltale signs: predictable service names, output files named with a distinctive timestamp pattern, hardcoded strings. More durably, the behaviors themselves are detectable, as network-monitoring vendors have documented: a service appearing and vanishing (event 7045), a scheduled task created and immediately deleted (event 4698), a workstation suddenly requesting directory replication it has no business requesting, or a burst of Kerberos service-ticket requests. Enforcing SMB and LDAP signing closes the door on relay attacks. Rotating the krbtgt password, twice, invalidates golden tickets. Auditing who holds replication rights limits DCSync. The uncomfortable truth is that the same qualities that make Impacket an excellent teaching library, its faithful, readable implementation of how Windows really talks to itself, are what make it an excellent weapon. The scripts have not changed much in years because they have not needed to; the protocols they abuse have not changed either. The next time a breach report lands with wmiexec.py in the timeline, the more interesting question is not how the attacker got the tool. It is how they got the credential that made the tool work, and why the network was built to trust it.

Sources

1. Cybersecurity and Infrastructure Security Agency (CISA), "Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization" (AA22-277A), 2022.
2. Fortra / Core Security, Impacket repository README, 2026.
3. MITRE ATT&CK, Impacket, Software S0357, last modified 2026.
4. The Hacker Recipes, DCSync, accessed 2026.
5. The Hacker Recipes, NTLM Relay, accessed 2026.
6. Ally Petitt, "Windows Remoting: Difference between psexec, wmiexec, atexec, *exec", Medium, 2023.
7. ExtraHop, "Breaking Through Encrypted East-West Traffic: How to Detect Impacket's Hidden Lateral Movement", accessed 2026.
8. Red Canary, Impacket, Threat Detection Report, accessed 2026.
9. Positive Technologies (PT SWARM), "Kerberoasting without SPNs", accessed 2026.
10. Bitdefender TechZone, "What is Impacket", accessed 2026.