1. Home
  2. Software
  3. Impacket

Impacket

Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.[1]

ID: S0357
ⓘ
Type: TOOL
ⓘ
Platforms: Linux, macOS, Windows
Contributors: Jacob Wilkin, Trustwave, SpiderLabs
Version: 1.7
Created: 31 January 2019
Last Modified: 07 October 2024
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1557 .001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.[1]
Enterprise T1040 Network Sniffing

Impacket can be used to sniff network traffic via an interface or raw socket.[1]
Enterprise T1003 .001 OS Credential Dumping: LSASS Memory

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.[1]
.002 OS Credential Dumping: Security Account Manager

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.[1]
.003 OS Credential Dumping: NTDS

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.[1]
.004 OS Credential Dumping: LSA Secrets

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.[1]
Enterprise T1558 .003 Steal or Forge Kerberos Tickets: Kerberoasting

Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.[1]
.005 Steal or Forge Kerberos Tickets: Ccache Files

Impacket tools – such as getST.py or ticketer.py – can be used to steal or forge Kerberos tickets using ccache files given a password, hash, aesKey, or TGT.[2][3]
Enterprise T1569 .002 System Services: Service Execution

Impacket contains various modules emulating other service execution tools such as PsExec.[1]
Enterprise T1047 Windows Management Instrumentation

Impacket's wmiexec module can be used to execute commands through WMI.[1]

Groups That Use This Software

ID Name References
G1016 FIN13

[4]
G0059 Magic Hound

[5]
G0096 APT41

APT41 used Impacket to dump LSA secrets on one of the domain controllers in the victim network.[6]
G0125 HAFNIUM

[7]
G0027 Threat Group-3390

[8]
G0035 Dragonfly

[9][10]
G1021 Cinnamon Tempest

[11][12]
G1017 Volt Typhoon

[13][14][15]
G0016 APT29

[16]
G0045 menuPass

[17]
G0034 Sandworm Team

[18]
G1003 Ember Bear

Ember Bear has used Impacket for lateral movement and process execution in victim environments.[19][20]
G0061 FIN8

[21][22]
G1001 HEXANE

HEXANE probed victim infrastructure in support of HomeLand Justice.[23]
G1015 Scattered Spider

[24]

Campaigns

ID Name Description
C0027 C0027

During C0027, Scattered Spider used Impacket for lateral movement.[24]
C0029 Cutting Edge

[25]
C0038 HomeLand Justice

[23]
C0014 Operation Wocao

During Operation Wocao, threat actors used smbexec.py and psexec.py from Impacket for lateral movement.[26]

References

  1. SecureAuth. (n.d.). Retrieved January 15, 2019.
  2. Adepts of 0xCC. (2021, January 28). The Kerberos Credential Thievery Compendium (GNU/Linux). Retrieved September 17, 2024.
  3. Boal, Calum. (2020, January 28). Abusing Kerberos From Linux - An Overview of Available Tools. Retrieved September 17, 2024.
  4. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.
  5. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
  6. DCSO CyTec Blog. (2022, December 24). APT41 — The spy who failed to encrypt me. Retrieved June 13, 2024.
  7. Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.
  8. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
  9. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  10. Core Security. (n.d.). Impacket. Retrieved November 2, 2017.
  11. Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.
  12. Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.
  13. Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.
  1. NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
  2. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  3. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.
  4. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  5. MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.
  6. Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
  7. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.
  8. Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.
  9. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  10. MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.
  11. Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023.
  12. Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.
  13. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.