📦 Outpacket

Tired of impacket? This cheatsheet maps common impacket workflows to their modern alternatives

---

Index

• Auth Quick Reference
• 1. Remote Execution
  • WMI Exec · wmiexec.py
  • DCOM Exec · dcomexec.py
  • Service-Based Exec · smbexec.py · psexec.py
  • Scheduled Task Exec · atexec.py
  • Bulk Execution · wmiexec.py · psexec.py
• 2. Kerberos
  • Request TGT · getTGT.py
  • Request TGS · getST.py
  • S4U2self / S4U2proxy · getST.py -impersonate
  • Kerberoasting · GetUserSPNs.py
  • AS-REP Roasting · GetNPUsers.py
  • ccache Roasting
  • Pre-Auth / Enc-Type Probe · GetNPUsers.py
  • PKINIT NT Hash Recovery
  • Ticket Renewal · getST.py -renew
  • Ticket Format Conversion · ticketConverter.py
  • Change Password · changepasswd.py
  • Golden / Silver Ticket · ticketer.py
• 3. SMB / File Operations
  • List Shares · smbclient.py -shares
  • Browse / List Files · smbclient.py
  • Download a File · smbclient.py get
  • Download with Backup Semantics
  • Upload a File · smbclient.py put
  • Create / Remove Directories and Files · smbclient.py
  • List Named Pipes · smbclient.py
  • Pass the Hash — SMB · smbclient.py -hashes
  • SMB over SOCKS5 · proxychains smbclient.py
  • Enumerate Open Files / Sessions · netview.py
  • Remote File Timestomping
  • VSS Snapshot Enumeration · smbclient.py list_snapshots
  • NTFS Alternate Data Streams
  • Server NIC Enumeration
  • Bulk Share Enumeration · smbclient.py
• 4. Credential Dumping
  • LSASS Minidump Parsing
  • Dump SAM Hashes · secretsdump.py -sam
  • Dump LSA Secrets · secretsdump.py -lsa
  • Dump SAM + LSA Together · secretsdump.py
  • Bulk SAM / LSA Dump · secretsdump.py
  • NTDS Dump via VSS Snapshot · secretsdump.py -use-vss
  • NTDS Dump via IFM · wmiexec.py · smbclient.py
  • NTDS Dump via wbadmin · wmiexec.py
  • NTDS Dump via Diskshadow · wmiexec.py · smbclient.py
  • NTDS Dump via Kerb-Key-List · secretsdump.py -use-keylist
  • NTDS Offline Parsing · secretsdump.py
  • DCSync · secretsdump.py · Dsrep rep
• 5. Enumeration
  • Domain Users (SAMR) · samrdump.py · net.py
  • Groups / Local Aliases · net.py group · net.py localgroup
  • SID Brute Force / Lookup · lookupsid.py
  • RPC Endpoints · rpcdump.py · rpcmap.py
  • Query WMI · wmiquery.py
  • WMI Method Invocation · wmiexec.py
  • Remote Registry · reg.py
  • Registry Key Security Descriptor
  • Service Enumeration · services.py
  • LSA Privilege Management
  • LSA Privilege and Account Enumeration
• 6. Active Directory / LDAP
  • Enumerate AD Users / Computers · GetADUsers.py · GetADComputers.py
  • GPO and Domain Trust Enumeration · ldapsearch · bloodyAD
  • Find Delegation Configurations · findDelegation.py
  • Add a Computer Account · addcomputer.py
  • Add a User Account · net.py user -add
  • Set RBCD · rbcd.py
  • DACL Abuse · dacledit.py · owneredit.py
  • User Attribute Modification (UAC) · net.py
• 7. Auth Coercion · printerbug.py · dfscoerce.py
  • Coerce + Relay Pattern · ntlmrelayx.py · smbserver.py (capture)
• 8. Certificates
  • Self-Signed PFX Generation
  • ADCS Template Enumeration · netexec ldap -M adcs
  • ADCS ESC1
• 9. Exotic Credential Harvest
  • certsync — Golden Cert + UnPAC the Hash
  • DPAPI Domain Backup Key — Mass Credential Decryption

---

Auth Quick Reference