Post-ex
Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.
What it is
Impacket speaks SMB, DCE/RPC, Kerberos, and LDAP from a Linux jump box. Use it to demonstrate access the graph predicted: authenticated SMB listing, Kerberos operations, and protocol-level proofs. It is not a license to dump NTDS or leave tokens behind.
Reach for it when
Internal post-ex when you already have in-scope credentials and need to prove a protocol-level path without installing an agent.
Watch-outs
secretsdump, ntlmrelayx, and ticket-forging utilities are in this repo — RoE must name which of them you may run. No DCSync unless written. No golden/silver tickets left at close. Prefer Kerberos over NTLM when the client has a signing mandate.
Typical invocation
impacket-smbclient 'CORP/[email protected]' -k -no-pass
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.
- BloodHound
Graph analysis of Active Directory and hybrid identity attack paths from authorized collection.
- Certipy
Active Directory Certificate Services enumeration and abuse-path analysis for authorized AD CS reviews.
- Responder
LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.