Greetings, fellow hackers and pen testers! In this article, I’ll walk you through the process of installing Impacket, a powerful and widely used Python library for working with network protocols. Impacket is a must-have tool for any red teamer or pen tester, as it provides a wealth of functionality for interacting with Windows networks, exploiting vulnerabilities, and more. By the end of this article, you can confidently install Impacket on your machine and start using it in your next engagement.

What is Impacket?

Before we dive into the installation process, let’s take a quick look at Impacket and its capabilities. Impacket is a collection of Python classes for working with network protocols, with a focus on the SMB protocol used in Windows networking. It allows you to perform a wide range of tasks, including network scanning, password cracking, and exploiting vulnerabilities in Windows systems.

Impacket includes several useful tools and utilities, including:

  • smbclient: A command-line client for interacting with SMB shares and performing file transfers
  • rpcclient: A command-line client for interacting with RPC services
  • samrdump: A tool for extracting user account information from Windows SAM databases
  • wmiexec: A tool for executing commands on remote Windows systems using the Windows Management Instrumentation (WMI) protocol
  • psexec: A tool for executing commands on remote Windows systems using the Windows Service Control Manager (SCM) protocol

These tools can be incredibly useful in various situations, from performing recon on a network to gaining remote access to a compromised system. With that in mind, let’s get started with the installation process.

Installing Impacket

Step 1: Install Python and pip

Before installing Impacket, you’ll need to ensure you have Python and pip installed on your system. If you’re using a Linux or macOS system, Python is probably already installed. To check, open a terminal window and type:

python --version

If you see output that looks like Python 2.7.18, your system has Python installed—but it’s outdated. Impacket requires Python 3, so consider upgrading. Ideally, you’ll see something like:

Python 3.10.6

If not, you can download and install It from the official Python website.

Once you install Python, you’ll also need to install pip, which is the Python package manager. Again, pip may already be installed if you’re using a Linux or macOS system. You can check by typing:

pip --version

If you see output that looks something like this:

pip 21.0.1 from /usr/local/lib/python3.9/site-packages/pip (python 3.9)

Then pip is already installed. If you need help, you can download and install pip from the official pip website.

Step 2: Install Impacket

With Python and pip installed, you’re ready to install Impacket. To do so, open a terminal window and type:

pip install impacket

Note: While you can install Impacket via pip, many users prefer cloning it from GitHub to access all of the script tools like wmiexec.py, secretsdump.py, and others.

To install Impacket from the GitHub repository, run:

git clone https://github.com/fortra/impacket.git
cd impacket
pip install .

This will download and install the latest version of Impacket from the Python Package Index (PyPI). Depending on your system and network speed, this may take a few minutes.

Once the installation is complete, you can test that Impacket is installed correctly by running one of the included tools, such as smbclient. To do so, open a terminal window and type:

smbclient.py -h

This will display the help screen for smbclient, indicating that it’s installed and ready to use.

Step 3: Interacting with Remote Windows Systems using Impacket

Now that you have Impacket installed, let’s examine how you can interact with a remote Windows system using it. One of the most useful tools in Impacket for this purpose is wmiexec.py, which allows you to execute commands on a remote Windows system using the Windows Management Instrumentation (WMI) protocol.

To use wmiexec.py, you’ll need valid credentials for a user account on the target system. You’ll also need the IP address or hostname of the system you want to connect to.

To start, open a terminal window and navigate to the directory where Impacket is installed. This is typically something like "/usr/local/lib/python3.9/site-packages/impacket" on Linux or macOS systems.

Next, run the following command to use wmiexec.py to execute a command on the remote system:

python3 wmiexec.py <TARGET IP ADDRESS> -hashes <NTLM HASH> <USERNAME> <COMMAND TO EXECUTE>

Replace <TARGET IP ADDRESS> with the IP address or hostname of the remote system you want to connect to. Replace <NTLM HASH> with the NTLM hash of the user account you want to use for authentication. If you don’t have the NTLM hash, you can use the “-hashes LMHASH:NTHASH” option instead and supply the plaintext password for the user account. Replace <USERNAME> with the username for the user account you want to use for authentication. Finally, replace <COMMAND TO EXECUTE> with the command you want to execute on the remote system.

For example, if you want to execute the “net user” command on a remote system with IP address 192.168.1.100, using the “user1” account with password “Pass123”, you would run the following command:

python3 wmiexec.py 192.168.1.100 -hashes aad3b435b51404eeaad3b435b51404ee:80459b...f2b41 user1 "net user"

This will connect to the remote system using WMI, authenticate using the supplied credentials, and execute the “net user” command. The output of the command will be displayed in your terminal window.

Keep in mind that wmiexec.py is just one of many tools included in Impacket that can be used to interact with Windows systems. Depending on your needs and the specific target environment, other Impacket tools like psexec.py, smbclient.py, or rpcclient.py may be more appropriate. Take the time to explore the Impacket documentation and familiarize yourself with the full range of tools and functionality it provides.

Real-world Example: Dumping and Cracking Hashes with Impacket

One powerful use of Impacket is to extract password hashes from a live system or image using secretsdump.py. You can run this against a live host if you have valid credentials:

secretsdump.py domain/user:password@192.168.1.100

Or if you have NTLM hashes instead of a password:

secretsdump.py -hashes LMHASH:NTHASH domain/user@192.168.1.100

This will dump NTLM hashes from the target system, which you can then crack using tools like hashcat. Assuming you save the hashes into a file called hashes.txt and have a wordlist named rockyou.txt, use:

hashcat -m 1000 -a 0 hashes.txt rockyou.txt

This tells hashcat to use NTLM mode (-m 1000) and try straight wordlist-based guesses (-a 0) from the supplied wordlist.

Cracking success depends on password complexity and the quality of your wordlist.

Conclusion

In this article, we’ve covered the basics of installing and using Impacket, a powerful Python library for working with network protocols. We’ve looked at some of the included tools and utilities, including smbclient, rpcclient, samrdump, wmiexec, and psexec, and demonstrated how to use Impacket to perform password cracking attacks on Windows systems.

Impacket is a versatile and powerful tool that every red teamer and pen tester should have in their arsenal. By mastering Impacket and combining it with other tools and techniques, you’ll be able to perform advanced network reconnaissance and penetration testing activities, uncovering vulnerabilities and weaknesses that can be exploited to gain unauthorized access to target systems and networks.

Remember, however, that with great power comes great responsibility. Always use Impacket and other hacking tools ethically and responsibly, and never use them for malicious or illegal purposes. With that in mind, happy hacking!

For more information, check out the official Impacket repository:
https://github.com/fortra/impacket