Impacket

v0.12.0Fortra (SecureAuth)

A protocol library with a famous set of example scripts: secretsdump, psexec, wmiexec, smbclient, GetNPUsers, GetUserSPNs, ntlmrelayx. Blue teams learn its network signature because almost every AD intrusion report mentions it. The range reproduces the command surface and the exact telemetry each script leaves behind.

Category: Post-exploitation & lateral movement
Package: impacket-scripts
Runs on: Linux · Windows
Commands: impacket-secretsdump, impacket-psexec, impacket-wmiexec, impacket-smbclient, impacket-GetNPUsers, impacket-GetUserSPNs, impacket-ntlmrelayx

Reads authored directory and host state, and writes the matching Windows event telemetry. No SMB or Kerberos traffic exists.

Install it

The scripts below install the real Fortra (SecureAuth) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-impacket.sh

Windows installer (PowerShell)

Install-impacket.ps1

Impacket has no unattended Windows install. Follow the steps on the package page.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Python (pip)

Install the interpreter tooling
```
sudo apt install -y python3-pip
```
Install Impacket
```
python3 -m pip install impacket-scripts
```
Use a virtual environment on a shared host so the system Python stays clean.

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Impacket
```
sudo apt install -y impacket-scripts
```

Check it worked

Confirm it landed on PATH
```
which impacket-secretsdump
```
Check the version
```
impacket-secretsdump --version
```
The range reports 0.12.0.

Remove it

Take it off again

python3 -m pip uninstall impacket-scripts

On Windows

Python (pip)

Install Python

winget install --id Python.Python.3.12 -e

Install Impacket
```
py -m pip install impacket-scripts
```

Check it worked

Confirm it resolves
```
where impacket-secretsdump
```
Check the version
```
impacket-secretsdump --version
```
The range reports 0.12.0.

Remove it

Take it off again
```
winget uninstall --id impacket-scripts
```

Inside the range

Tick it on the launch screen
Under Impacket's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y impacket-scripts
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Impacket

Pentest: Read the AD Attack GraphUse the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.
Pentest: Purple-Team EmulationPlay both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Pentest: C2 Operations and TunnelingStand up a small beacon fleet in the /pentest/c2 console, run it over jittered HTTPS and a DNS fallback, stage a compressed collection and file the tunnel-and-egress finding — beacon fingerprints, jitter, callback cadence, all in the report.
Pentest: Ransomware Adversary EmulationEmulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.