ChangeLog.md
Project owner's main page is at www.coresecurity.com.
Complete list of changes can be found at: https://github.com/fortra/impacket/commits/master
Library improvements
Major SMB client/server refactor adds setInfo support, CIFS datetime helpers, and safer default share access to enable remote attribute and timestamp management. (@covertivy)
Introduced per-structure encoding selectors and UTF-8-aware SMB structures so non-Latin resource names round-trip correctly. (@alexisbalbachan)
Strengthened LDAP/Kerberos handling with channel binding plus signing, schema alignment with ldap3, and LDAPS-based LAPS retrieval against Windows Server 2025 DCs. (@zblurx, @alexisbalbachan, @Ibrahim8879)
Improved DCE/RPC coverage with Netlogon authenticator fixes, updated DRS bind flags, expanded EVEN6 decoding, and a new ICPR interface to support relay-aware RPC workflows. (@ThePirateWhoSmellsOfSunflowers, @h3-josh-the-engineer, @NtAlexio2, @rtpt-romankarwacik)
Corrected SMB negotiation edge cases by fixing response padding, Unicode pipe lookups, and keyboard interrupts in SMB servers. (@rtpt-erikgeiser, @Abyss-emmm, @exploide)
SMB Server enhancements to align Impacket's implementation with standard (@jborean93)
Authentication & relay tooling
Added WinRMS relay clients/servers. (@Defte_)
Improved IPv6 support, richer logging, and consistent console status reporting, plus an identity log to track compromised principals ( @gabrielg5)
Introduced an RPC relay server with Endpoint Mapper discovery . (@rtpt-romankarwacik)
Delivered SCCM Management/Distribution Point relay attacks. (@q-roland)
Enhanced shadow credentials, SOCKS plugins, and target rotation with better IPv6 awareness and stability. (@anadrianmanrique, @gabrielg5)
Added options to strip SSP from Net-NTLMv1 captures and write relay-captured hashes for cracking workflows. (@TurtleARM, @p0rtL6)
Examples improvements
secretsdump.py gained a WMI shadow snapshot path, export hive boot key recovery, safer DRS flags, user-status reporting, and refined NTDS parsing. (@PeterGabaldon, @MaxToffy, @h3-josh-the-engineer, @Markb1337, @snovvcrash)
MSSQL tooling gained channel binding tokens, restored reliable connections, richer linked-server file transfers, and inline command execution. (@Defte_, @rtpt-romankarwacik, @trietend, @kiriknik, @Signum21)
Directory ACL helpers (dacledit, owneredit, rbcd, ldapshell) picked up mask selection, safer queries, and consistent -dc-host handling. (@dadevel, @shellinvictus, @Fabrizzio53, @ICheer_No0M, @gabrielg5)
SMB operator utilities add reconnect and autocomplete options in smbclient and prevent smbexec from hanging on completion. (@daddycocoaman, @trietend, @Vincent550102)
Remote access helpers such as rdp_check and wmiexec now support IPv6 targets and display created Process IDs for easier triage. (@gabrielg5, @alexisbalbachan)
New examples
attrib.py manipulates file attributes over SMB to showcase the new setInfo workflow. (@covertivy)
filetime.py inspects and updates SMB file timestamps using the refreshed SMBConnection APIs. (@covertivy)
badsuccessor.py demonstrates the AD CS “bad successor” attack path. (@fulc2um)
regsecrets.py extracts LSA secrets from remote registry hives through [MS-RRP]. (@laxaa, @laxa)
samedit.py edits local SAM password hashes offline. (@iorpim)
CheckLDAPStatus.py checks LDAP signing status and LDAPS channel binding status. (@zblurx)
Project & packaging
Added the impacket.mssql namespace, relaxed the pyOpenSSL pin, and declared Python 3.13 support while dropping 3.8. (@anadrianmanrique, @Defte_)
Replaced pkg_resources with importlib.metadata for lightweight version discovery. (@AdrianVollmer)
Contributors
As always, thanks a lot to all these contributors that make this library better every day (up to now):
@Abyss-emmm, @AdrianVollmer, @NeffIsBack, @NtAlexio2, @rtpt-alexanderneumann, @asareynolds, @dadevel, @TurtleARM, @Defte_, @rtpt-erikgeiser, @Fabrizzio53, @fluffy-kaiju, @gabrielg5, @ICheer_No0M, @exploide, @jborean93, @nitbx, @laxaa, @daddycocoaman, @lucas0817, @Markb1337, @MaxToffy, @Ibrahim8879, @Narmjep, @NuclearFizzler, @iorpim, @CipherCloak, @PeterGabaldon, @b1two, @covertivy, @rtpt-romankarwacik, @ryanq47, @SAERXCIT, @Signum21, @ThePirateWhoSmellsOfSunflowers, @Vincent550102, @anadrianmanrique, @alexisbalbachan, @d0gkiller87, @Ridter, @fulc2um, @gjhami, @h3-josh-the-engineer, @kiriknik, @marcobarlottini, @p0rtL6, @q-roland, @shellinvictus, @trietend, @zblurx.
Library improvements
[MS-GKDI] Group Key Distribution Protocol implementation (@zblurx)Examples improvements
tree command (@trietend)-target-ip parameter to allow Kerberos authentication without much change in the DNS configuration of the local machine (@Palkovsky)enum_impersonate command (@exploide)New examples
As always, thanks a lot to all these contributors that make this library better every day (up to now):
@tomspencer @anadrianmanrique @ShutdownRepo @dadevel @gjhami @NtAlexio2 @F-Masood @BlWasp @gabrielg5 @XiaoliChan @omry99 @Wlayzz @themaks @alexisbalbachan @RazzburyPi @jeffmcjunkin @p0dalirius @dc3l1ne @jfjallid @Palkovsky @rtpt-erikgeiser @trietend @zblurx @dru1d-foofus @PfiatDe @DidierA @marcobarlottini @PeterGabaldon @m8r1us @5yn @tzuralon @Adamkadaban @scarvell @JerAxxxxxxx @ujwalkomarla @robnanola @SAERXCIT @nurfed1 @A1vinSmith @joeldeleep @nopernik
Library improvements
[MS-TSTS] Terminal Services Terminal Server Runtime Interface Protocol implementation (@nopernik).Examples improvements
New examples
As always, thanks a lot to all these contributors that make this library better every day (up to now):
@ly4k @nopernik @snovvcrash @ShutdownRepo @kiwids0220 @mpgn @CT-H00K @rmaksimov @arossert @aevy-syn @tirkarthi @p0dalirius @Dramelac @Mayfly277 @S3cur3Th1sSh1t @nobbd @AdrianVollmer @trietend @TurtleARM @ThePirateWhoSmellsOfSunflowers @SAERXCIT @clavoillotte @Marshall-Hallenbeck @sploutchy @almandin @rtpt-alexanderneumann @JerAxxxxxxx @NtAlexio2 @laxa @godylockz @exploide @jojonas @Zamanry @erasmusc @bugch3ck @ljrk0 @Sq00ky @shoxxdj @Alef-Burzmali @bransh @api0cradle @alexisbalbachan @0xdeaddood @NtAlexio2 @sanmopre
Library improvements
pytest as the testing framework to organize and mark test
cases. Tox remain as the automation framework, and Coverage.py
for measuring code coverage.[MS-PAR], [MS-RPRN], CCache and DPAPI.[MS-NRPC] (@0xdeaddood)[MS-DSSP] protocol implementation (@simondotsh)[MS-PAR] and [MS-RPRN] (@raithedavion)Examples improvements
New examples
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@rmaksimov @simondotsh @CCob @raithedavion @SAERXCIT @Maltemo @dirkjanm @reznok @ShutdownRepo @scopedsecurity @Tw1sm @nodauf @p0dalirius @zblurx @hugo-syn @capnkrunchy @mohemiv @mpgn @rtpt-jonaslieb @snovvcrash @alefburzmali @ThePirateWhoSmellsOfSunflowers @jlvcm
Library improvements
[MS-RPRN]: Print System Remote Protocol (@cube0x0)[MS-PAR]: Print System Asynchronous Remote Protocol (@cube0x0)[MS-RPCH] with HTTP/1.1 (@mohemiv)Examples improvements
New examples
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@deadjakk @franferrax @cube0x0 @w0rmh013 @skelsec @mohemiv @LZD-TMoreggia @exploide @ShutdownRepo @Hackndo @snovvcrash @rmaksimov @Gifts @Rcarnus @ExAndroidDev @ly4k @p0dalirius
Library improvements
smbserver.py - CVE-2021-31800 (@omriinbar AppSec Researcher at CheckMarx)httprelayserver.py (@Rcarnus)smbclient.py (@mxrch)Examples improvements
filterBinding error (@franferrax)dcomexec.py, smbexec.py
and wmiexec.py (@snovvcrash)COMVERSION in dcomexec.py, wmiexec.py,
wmipersist.py and wmiquery.py (@zexusx26)New examples
smbpasswd tool and
intended to be used for changing expired passwords remotely over SMB (MSRPC-SAMR) (@snovvcrash)As always, thanks a lot to all these contributors that make this library better every day (since last version):
@mpgn @vruello @mohemiv @jagotu @jakekarnes42 @snovvcrash @zexusx26 @omriinbar @Rcarnus @nuschpl @mxrch @ShutdownRepo @p0dalirius @AdamCrosser @franferrax @meeuw and @cclauss
Library improvements
[MS-NSPI], [MS-OXNSPI] and [MS-OXABREF] protocol implementations (by @mohemiv).[MS-NLMP] 2.2.2.10 VERSION structure in NTLMAuthNegotiate messages (by @franferrax).NetrServerPasswordSet2 (by @dirkjanm).Examples improvements
-no-pass, pass-the-hash and AES Key support for backup subcommand.New examples
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@mohemiv @mpgn @Romounet @ThePirateWhoSmellsOfSunflowers @rmaksimov @fuzzKitty @tshmul @spinenkoia @AaronRobson @ABCIFOGeowi40 @cclauss @cnotin @5alt @franferrax @Dliv3 @dirkjanm @Mr-Gag @vbersier @phefley @Hackndo
Library improvements
CCache class to import/export kirbi (KRB-CRED) formatted tickets (by @Zer1t0).FSCTL_SRV_ENUMERATE_SNAPSHOTS functionality to SMBConnection (by @rxwx).nmb.py (select() by poll() read from socket) (by @cnotin).tsch.py (by @mohemiv).Examples improvements
-remote-binary-name flag.-service-name flag.New Examples
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@jagotu, @Zer1t0 ,@rxwx, @mpgn, @danhph, @awsmhacks, @slasyz, @cnotin, @exploide, @G0ldenGunSec, @dirkjanm, @0xdeaddood, @MaxNad, @imaibou, @BarakSilverfort, @0xe7, @mlefebvre, @rmaksimov, @praetorian-adam-crosser, @jsherwood0, @mohemiv, @justin-p, @cube0x0, @spinenkoia, @kcirtapw, @MrAnde7son, @fridgehead, @MarioVilas.
Library improvements
Examples improvements
New Examples
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@infinnovation-dev, @cnotin, @mikeryan, @SR4ven, @cclauss, @skorov, @msimakov, @dirkjanm, @franferrax, @iboukris, @n1ngod, @c0d3z3r0, @MrAnde7son.
Library improvements
Examples improvements
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@dirkjanm, @MrAnde7son, @ibo, @franferrax, @Qwokka, @CaledoniaProject , @eladshamir, @Zer1t0, @martingalloar, @muizzk, @Petraea, @SR4ven, @Fist0urs, @Zer1t0.
Library improvements
Examples improvements
DPAPI_SYSTEM LSA Secret is now parsed and key contents are shown.New Examples
As always, thanks a lot to all these contributors that make this library better every day (since last version):
@dirkjanm, @MrAnde7son, @franferrax, @MrRobot86, @qlemaire, @cauan, @eldipa.
Library improvements
[MS-PAC] Implementation.EAPOL, BOOTP and DHCP packet
decoders (by Michael Niewoehner)DES-CBC-MD5 support to kerberos added (by @skelsec)[MS-DHCPM] and [MS-EVEN6] Interface implementation by @MrAnde7sonExamples improvements
-request-user parameter added. Requests STs for the SPN associated to the user
specified. Added support for AES Kerberoast tickets (by @elitest).-csv switch to output format in CSV added.New Examples
PAC_LOGON_INFO structure, in particular the
groups, extrasids, duration, etc. Silver tickets creation by @machosec and @bransh.[MS-SFU]'s S4USelf + User to User
Kerberos Authentication.-so parameter.wmiexec.py,
but using different DCOM endpoints. Currently supports MMC20.Application, ShellWindows and
ShellBrowserWindow objects. (contributions by @byt3bl33d3r).-impersonate
switch to request the ticket on behalf other user.As always, thanks a lot to all these contributors that make this library better every day (since last version):
@dirkjanm, @real-datagram, @kacpern, @martinuy, @xelphene, @blark, @the-useless-one, @contactr2m, @droc, @martingalloar, @skelsec, @franferrax, @Fr0stbyt3, @ropnop, @MrAnde7son, @machosec, @federicoemartinez, @elitest, @symeonp, @Kanda-Motohiro, @Ramzeth, @mohemiv, @arch4ngel, @derekchentrendmicro, @Kayzaks, @donwayo, @bao7uo, @byt3bl33d3r, @xambroz, @luzpaz, @TheNaterz, @Mikkgn, @derUnbekannt.
Library improvements
SMB3.create: define CreateContextsOffset and CreateContextsLength when applicable (by @rrerolle)CCache file allowing to call any script with -k and just the target system (by @MrTchuss)Examples improvements
-dc-ip switch to all examples. It allows specifying what the IP for the domain is.
It assumes the DC and KDC resides in the same server.secretsdump.py:
-use-vss mode-just-dc-user switch to download just a single user data (DRSUAPI mode only)wmiquery.py:
-rpc-auth-level switch (by @gadio)smbrelayx.py:
New Examples
GetUserSPNs.py: This module will try to find Service Principal Names that are associated with normal user account.
This is part of the kerberoast attack researched by Tim Medin (@timmedin)ntlmrelayx.py: smbrelayx.py on steroids!. NTLM relay attack from/to multiple protocols (HTTP/SMB/LDAP/MSSQL/etc)
(by @dirkjanm)Library improvements
[MS-TSCH] - ATSVC, SASec and ITaskSchedulerService Interface implementations[MS-DRSR] - Directory Replication Service DRSUAPI Interface implementationExamples improvements
mssqlclient.py:
atexec.py:
smbrelayx.py:
secretsdump.py:
[MS-DRSR] (IDL_DRSGetNCChanges method)
by default. VSS method is still available by using the -use-vss switch-just-dc (Extract only NTDS.DIT NTLM Hashes and Kerberos) and
-just-dc-ntlm (only NTDS.DIT NTLM Hashes) options-resumefile option.[MS-SAMR] 3.1.1.8.11.5)goldenPac.py:
New examples
raiseChild.py: Child domain to forest privilege escalation exploit. Implements a
child-domain to forest privilegeescalation as detailed by Sean Metcalf.netview.py: Gets a list of the sessions opened at the remote hosts and keep track of them (original idea by @mubix)Library improvements
kerberosLogin() added to SMBConnection (all SMB versions).RPC_C_AUTHN_GSS_NEGOTIATE at the DCERPC layer. This will
negotiate Kerberos. This also includes DCOM.RC4, AES128_CTS_HMAC_SHA1_96 and AES256_CTS_HMAC_SHA1_96 ciphers.RPC_C_AUTHN_LEVEL_PKT_PRIVACY/RPC_C_AUTHN_LEVEL_PKT_INTEGRITY.[MS-SAMR]: Supplemental Credentials support (used by secretsdump.py)impacket.Examples improvements
secretsdump.py:
smbserver.py:
smbrelayx.py:
New examples
goldenPac.py: MS14-068 exploit. Saves the golden ticket and also launches a
psexec session at the target.karmaSMB.py: SMB Server that answers specific file contents regardless of
the SMB share and pathname requested.wmipersist.py: Creates persistence over WMI. Adds/Removes WMI Event
Consumers/Filters to execute VBS based on a WQL filter or timer specified.Library improvements
[MS-DCOM] - Distributed Component Object module Protocol (dcom.py)[MS-OAUT] - OLE Automation Protocol (dcom/oaut.py)[MS-WMI]/[MS-WMIO] : Windows Management Instrumentation Remote Protocol (dcom/wmi.py)New examples
wmiquery.py: executes WMI queries and get WMI object's descriptions.wmiexec.py: agent-less, semi-interactive shell using WMI.smbserver.py: quick an easy way to share files using the SMB protocol.Library improvements
impacket.dcerpc.v5, old one still available)
RPC_C_AUTHN_NETLOGON (experimental)[MS-LSAD] - Local Security Authority (Domain Policy) Remote Protocol (lsad.py)[MS-LSAT] - Local Security Authority (Translation Methods) Remote Protocol (lsat.py)[MS-NRPC] - Netlogon Remote Protocol (nrpc.py)[MS-RRP] - Windows Remote Registry Protocol (rrp.py)[MS-SAMR] - Security Account Manager (SAM) Remote Protocol (samr.py)[MS-SCMR] - Service Control Manager Remote Protocol (scmr.py)[MS-SRVS] - Server Service Remote Protocol (srvs.py)[MS-WKST] - Workstation Service Remote Protocol (wkst.py)[MS-RPCE]-C706 - Remote Procedure Call Protocol Extensions (epm.py)[MS-DTYP] - Windows Data Types (dtypes.py)New examples
rdp_check.py: tests whether an account (pwd or hashes) is valid against an RDP serveresentutl.py: ESE example to show how to interact with ESE databases (e.g. NTDS.dit)ntfs-read.py: mini shell for browsing an NTFS volumeregistry-read.py: Windows offline registry readersecretsdump.py: agent-less remote windows secrets dump (SAM, LSA, CDC, NTDS)Library improvements
[MS-SMB2]). Signing supported, encryption for
SMB3 still pending.smbconnection.py for a list of available methods across all the protocols.[MS-TDS] & [MC-SQLR]) so we could talk with MSSQL Servers.lookup(): It can work as a general portmapper, or just to find specific interfaces/objects.New examples
mssqlclient.py: A MS SQL client, allowing to do MS SQL or Windows Authentication (accepts hashes) and then gives
you an SQL prompt for your pleasure.mssqlinstance.py: Lists the MS SQL instances running on a target machine.rpcdump.py: Output changed. Hopefully more useful. Parsed all the Windows Protocol Specification looking for the
UUIDs used and that information is included as well. This could be helpful when reading a portmap output and to
develop new functionality to interact against a target interface.smbexec.py: Another alternative to psexec. Less capabilities but might work on tight AV environments. Based on the
technique described at https://web.archive.org/web/20190515131124/https://www.optiv.com/blog/owning-computers-without-shell-access. It also
supports instantiating a local smbserver to receive the output of the commandos executed for those situations
where no share is available on the other end.smbrelayx.py: It now also listens on port 80 and forwards/reflects the credentials accordingly.And finally tons of fixes :).
Library improvements
IP6_Address helper class.*SMBSERVER is specified the library will try to resolve the netbios name.SRVSVC: NetrShareEnum(Level1), NetrShareGetInfo(Level2), NetrServerGetInfo(Level2),
NetrRemoteTOD(), NetprNameCanonicalize().SVCCTL: CloseServiceHandle(), OpenSCManagerW(), CreateServiceW(), StartServiceW(),
OpenServiceW(), OpenServiceA(), StopService(), DeleteService(), EnumServicesStatusW(),
QueryServiceStatus(), QueryServiceConfigW().WKSSVC: NetrWkstaTransportEnum().SAMR: OpenAlias(), GetMembersInAlias().LSARPC: LsarOpenPolicy2(), LsarLookupSids(), LsarClose().New examples
ifmap.py: First, this binds to the MGMT interface and gets a list of interface IDs. It adds to this a large list
of interface UUIDs seen in the wild. It then tries to bind to each interface and reports whether the interface is
listed and/or listening.lookupsid.py: DCE/RPC lookup sid brute forcer example.opdump.py: This binds to the given hostname:port and DCERPC interface. Then, it tries to call each of the first
256 operation numbers in turn and reports the outcome of each call.services.py: SVCCTL services common functions for manipulating services (START/STOP/DELETE/STATUS/CONFIG/LIST).test_wkssvc: DCE/RPC WKSSVC examples, playing with the functions Implemented.smbrelayx: Passes credentials to a third party server when doing MiTM.smbserver: Multiprocess/threading smbserver supporting common file server functions. Authentication all done but
not enforced. Tested under Windows, Linux and MacOS clients.smbclient.py: now supports history, new commands also added.psexec.py: Execute remote commands on Windows machines