https://cybertoolchain.io/tools/impacket New releases and features in impacket, tracked by The Cyber Toolchain. en Tue, 19 May 2026 15:39:49 GMT https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_13_1 https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_13_1 Tue, 19 May 2026 15:39:49 GMT Impacket 0.13.1 adds MSSQL/RDP relay, dpapidump, TDS 8.0, WMI PutClass/DeleteClass, SMB ACL mgmt, shadow credentials, and more. • Adds `dpapidump.py`, a new example script for dumping DPAPI-related secrets. • Adds `checkMSSQLStatus.py`, a new example for checking MSSQL status and Channel Binding Token (CBT) behavior. • Adds MSSQL and RDP relay servers to `ntlmrelayx.py`, including strict MSSQL relay support and TLS-backed TDS frame reassembly. • Adds NTLM sign/seal removal paths and `--remove-mic` handling to `ntlmrelayx.py` for CVE-2025-33073-related relay workflows. • Adds shadow credentials commands to the interactive LDAP shell in `ntlmrelayx.py` with updated KeyCreds handling for January 2026 Windows changes. • Adds TDS 8.0 support in the MSSQL/TDS library for Force Strict Encryption targets, EPA channel binding, and TDS_SSVARIANT parsing. • Adds WMI `PutClass`/`DeleteClass` support and Remote Event Log subscription calls to the DCE/RPC and WMI layer. • Adds ACL management support, recursive `rget`, and richer share listing (type and comments) to `smbclient.py`. • Adds SMB server signing support, optional read-only shares, and Kerberos/NTLM authentication controls to the SMB server and relay. • Adds workstation/application name options, linked-server RPC enable/disable commands, and custom CBT support to `mssqlclient.py`. • Adds SAM history parsing to both `secretsdump.py` and `regsecrets.py`. • Adds SAM password timestamp output and offline NTDS row filtering by local domain SID to `secretsdump.py`. • Adds Remote Desktop Shadowing support to `tstool.py`. • Adds base64 output support and conversion of all TGS entries to `ticketConverter.py`. • Adds AES support for modern Windows environments and PAC buffer preservation to `raiseChild.py`. • Adds Basic Authentication support to `exchanger.py`. • Adds persistent registry key creation support to `reg.py`. • Adds an option to avoid forcing RC4-HMAC when requesting a TGT in `GetUserSPNs.py`. • Adds a reusable ACL helper module to the library. • Adds LDAP CRUD helpers and improved LDAP attribute handling. • Adds large-page ESE tag parsing for Windows Server 2025 NTDS.dit files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/fortra/impacket/blob/master/ChangeLog.md https://github.com/fortra/impacket/blob/master/ChangeLog.md Fri, 01 May 2026 00:00:00 GMT impacket 0.13.1 adds MSSQL/RDP relay to ntlmrelayx, new examples (dpapidump, tstool RDP shadow), and SMB server signing controls • Adds MSSQL and RDP relay servers to `ntlmrelayx.py` with strict MSSQL relay support and `--remove-mic` handling for CVE-2025-33073-related workflows • Introduces new `dpapidump.py` example to dump DPAPI secrets • Adds Remote Desktop Shadowing support to the `tstool.py` example • Adds SMB server signing controls, optional read-only shares, and Kerberos/NTLM authentication controls to the library's SMB server implementation • Adds WMI PutClass/DeleteClass support and Remote Event Log subscription calls to the DCE/RPC and WMI library modules • Adds LDAP CRUD helpers to the Directory and data parsing library module • Adds persistent registry key creation support to `reg.py` example • Adds Basic Authentication support to `exchanger.py` example • Adds a new option to avoid forcing RC4-HMAC when requesting a TGT in `GetUserSPNs.py` • Adds workstation/application name options and linked-server RPC enable/disable commands to `mssqlclient.py` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_13_0 https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_13_0 Wed, 22 Oct 2025 15:53:06 GMT Impacket 0.13.0 adds six new example tools, WinRM/RPC relay, SCCM relay attacks, and major SMB/LDAP/DCE-RPC capability expansions. • New `attrib.py` example manipulates file attributes over SMB using the new setInfo workflow. • New `filetime.py` example inspects and updates SMB file timestamps via refreshed SMBConnection APIs. • New `badsuccessor.py` example demonstrates the AD CS 'bad successor' attack path. • New `regsecrets.py` example extracts LSA secrets from remote registry hives via MS-RRP. • New `samedit.py` example edits local SAM password hashes offline. • New `CheckLDAPStatus.py` example checks LDAP signing status and LDAPS channel binding status. • Adds WinRM relay client/server support to the relay toolchain. • Introduces an RPC relay server with Endpoint Mapper discovery. • Delivers SCCM Management Point and Distribution Point relay attacks. • Adds SMB setInfo support, CIFS datetime helpers, and safer default share access for remote attribute and timestamp management. • Strengthens LDAP/Kerberos handling with channel binding plus signing and LDAPS-based LAPS retrieval against Windows Server 2025 DCs. • Adds a new ICPR DCE/RPC interface to support relay-aware RPC workflows. • Adds options to strip SSP from Net-NTLMv1 captures and write relay-captured hashes for cracking workflows. • `secretsdump.py` gains a WMI shadow snapshot path, export hive boot key recovery, and user-status reporting. • MSSQL tooling gains channel binding tokens, richer linked-server file transfers, and inline command execution. • Adds identity log to ntlmrelayx to track compromised principals. • `smbclient` gains reconnect and autocomplete options. • `rdp_check` and `wmiexec` now support IPv6 targets and display created Process IDs. • Adds `impacket.mssql` namespace for MSSQL-related imports. • Declares Python 3.13 support. Breaking changes: • Python 3.8 is no longer supported; upgrading requires Python 3.9 or later. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/fortra/impacket/blob/master/ChangeLog.md https://github.com/fortra/impacket/blob/master/ChangeLog.md Wed, 01 Oct 2025 00:00:00 GMT Impacket 0.13.0 adds attrib.py, filetime.py, badsuccessor.py, regsecrets.py, samedit.py scripts; sets new examples. • Added `attrib.py` example to manipulate file attributes over SMB via the new setInfo workflow • Added `filetime.py` example to inspect and update SMB file timestamps using refreshed SMBConnection APIs • Added `badsuccessor.py` example to demonstrate the AD CS "bad successor" attack path • Added `regsecrets.py` example to extract LSA secrets from remote registry hives through MS-RRP • Added `samedit.py` example to edit local SAM password hashes offline • Added `CheckLDAPStatus.py` example to check LDAP signing and LDAPS channel binding status Breaking changes: • Dropped Python 3.8 support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_12_0 https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_12_0 Mon, 16 Sep 2024 20:07:25 GMT Impacket 0.12.0 adds 5 new example scripts, Sapphire tickets, Kerberoasting via AS-REQ, S4U2self abuse flags, GKDI protocol support, and more. • New `describeTicket.py` script for Kerberos ticket description and decryption. • New `GetADComputers.py` script to query a DC via LDAP for computer objects and attributes including DNS name and OS version. • New `GetLAPSPassword.py` script to extract LAPS passwords from LDAP. • New `dacledit.py` script to read, write, remove, backup, and restore ACEs in an object's DACL. • New `owneredit.py` script to abuse WriteOwner (ADS_RIGHT_WRITE_OWNER) access rights and edit an object's DACL. • Adds `[MS-GKDI]` Group Key Distribution Protocol implementation to the library. • `ticketer.py` supports creating Sapphire tickets. • `GetUserSPNs.py` and `getTGT.py` support Kerberoasting without pre-authentication and ST requests through AS-REQ. • `getST.py` adds `-self`, `-altservice`, and `-u2u` flags for S4U2self abuse, S4U2self+u2u, and service substitution. • `getST.py` adds ability to set the RENEW ticket option to renew a TGT. • `secretsdump.py` doubles DC Sync performance for DCs supporting SID lookups. • `secretsdump.py` adds ability to skip dumping SAM or SECURITY hives during remote operations. • `secretsdump.py` adds ability to specify users to skip when dumping NTDS. • `ntlmrelayx.py` adds creation of new machine accounts through SMB. • `ntlmrelayx.py` adds `--keep-relaying` flag for multirelay target handling. • `ntlmrelayx.py` improves ability to continue relaying to ADCS web enrollment endpoint to request multiple certificates for different users. • `ntlmrelayx.py` writes certificates to file instead of outputting base64 to console. • `reg.py` supports adding Binary and REG_MULTI_SZ values, and can start the remote registry as an unprivileged user. • `smbclient.py` adds ability to write commands and output to a specified output file. • `smbserver.py` adds `-outputfile` parameter to set the log file. • `DumpNTLMInfo.py` supports execution on non-default ports. • `findDelegation.py` adds a new column showing whether an SPN exists. • `mssqlclient.py` adds `-target-ip` parameter to allow Kerberos authentication without DNS configuration changes. • `ldap_shell.py` adds support for `dirsync` and `whoami` commands. • `lookupsid.py` now supports Kerberos authentication. • `samrdump.py` fetches AdminComment via MSRPC. • `tstool.py` adds support for Kerberos authentication and SID resolution. • `getTGT.py` adds `principalType` as a new parameter. • SMB Server adds query information level 0x0109 (`SMB_QUERY_FILE_STREAM_INFO`) for SMB1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/fortra/impacket/blob/master/ChangeLog.md https://github.com/fortra/impacket/blob/master/ChangeLog.md Sun, 01 Sep 2024 00:00:00 GMT Impacket 0.12.0 adds DACL/ownership abuse scripts, LDAP LAPS extraction, Sapphire ticket support, and Kerberos improvements across many tools • Adds `[MS-GKDI]` Group Key Distribution Protocol implementation in the library • Adds `-outputfile` parameter to `smbclient.py` to write commands and output to a file • Adds `-outputfile` parameter to `smbserver.py` to set the log file path • Adds `--self`, `--altservice`, and `--u2u` flags to `getST.py` for S4U2self abuse, S4U2self+u2u, and service substitution • Adds ability to skip dumping SAM or SECURITY hives in `secretsdump.py` via a new skip option • Adds ability to specify users to skip when dumping NTDS in `secretsdump.py` • Adds support to create Sapphire tickets in `ticketer.py` • Adds Kerberoasting without pre-authentication and ST request through AS-REQ support in `GetUserSPNs.py` and `getTGT.py` • Adds principalType parameter to `getTGT.py` • Adds new machine account creation through SMB in `ntlmrelayx.py` • Adds `--keep-relaying` flag to `ntlmrelayx.py` for multirelay status • Adds configuration of SOCKS5 address and port in `ntlmrelayx.py` via a new option • Adds Write certificates to file functionality in `ntlmrelayx.py` • Adds improved ability to continue relaying to ADCS web enrollment endpoint in `ntlmrelayx.py` • Adds domain and username to interactive Ldap shell message in `ntlmrelayx.py` • Enhanced MSSQLShell in NTLMRelayX leveraging TcpShell & output messages • Allows adding Binary values in `reg.py` • Allows adding REG_MULTI_SZ values in `reg.py` • Adds `-target-ip` parameter to `mssqlclient.py` for Kerberos authentication • Adds support for dirsync and whoami commands in `ldap_shell.py` • Now supports kerberos auth in `lookupsid.py` • Added support for kerberos auth and resolves SIDs in `tstool.py` • New script `describeTicket.py` for ticket description and decryption • New script `GetADComputers.py` to query DC via LDAP for COMPUTER objects • New script `GetLAPSPassword.py` to extract LAPS passwords from LDAP • New script `dacledit.py` to read, write, remove, backup, restore ACEs in object DACL • New script `owneredit.py` to abuse WriteOwner access rights to take ownership Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_11_0 https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_11_0 Thu, 03 Aug 2023 17:36:40 GMT impacket 0.11.0 adds `net.py` and `changepasswd.py`, new `-dc-host`/`-stealth` flags, LDAP SASL auth, and `ms-tsts` support • Adds the `net.py` example implementing the Windows `net.exe` built-in tool via CLI. • Adds `changepasswd.py`, a new script to change or reset passwords across multiple protocols. • Adds `DumpNTLMInfo.py` to dump remote host NTLM information without credentials for SMB v1/v2/v3. • Adds `[MS-TSTS]` Terminal Services Terminal Server Runtime Interface Protocol implementation. • Supports SASL authentication in the LDAP protocol. • Adds `-dc-host` option to `GetADUsers.py`, `GetNPUsers.py`, `GetUserSPNs.py`, and `findDelegation.py` to connect to a specific KDC. • Adds ability to extract only NTDS.DIT data for specific users in `secretsdump.py` using an LDAP filter. • Adds new commands to `mssqlclient.py`, including support for `xp_dirtree` execution. • Enables SQLShell trigger in `ntlmrelayx.py` when running in interactive mode. • Adds DNS record registration capability via LDAP in `ntlmrelayx.py`. • Adds `-filter` option to the socks command in `ntlmrelayx.py` CLI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/fortra/impacket/blob/master/ChangeLog.md https://github.com/fortra/impacket/blob/master/ChangeLog.md Tue, 01 Aug 2023 00:00:00 GMT Impacket v0.11.0 adds net.py, changepasswd.py, DumpNTLMInfo.py, LDAP paged search, and new example options • Adds `net.py` example implementing the Windows `net.exe` builtin tool via SMB/RPC. • Adds `changepasswd.py` example allowing password changes or resets across multiple protocols. • Adds `DumpNTLMInfo.py` example to dump remote host information using NTLM auth without credentials (supports SMBv1/v2/v3). • Adds `-dc-host` option to `GetADUsers.py`, `GetNPUsers.py`, `GetUserSPNs.py`, and `findDelegation.py` to connect to a specific KDC by FQDN or NetBIOS name. • Adds `-stealth` flag to `GetUserSPRs.py` to remove the SPN filter from the LDAP query for improved evasion. • Adds LDAP paged search support in `GetUserSPNs.py` to handle large directory result sets without memory exhaustion. • Adds new commands and `xp_dirtree` execution support in `mssqlclient.py`. • Adds ability to register DNS records through LDAP in `ntlmrelayx.py`. • Adds SOCKS filter option to the `socks` command in `ntlmrelayx.py` CLI. • Adds `-outputfile` output to stdout in `GetNPUsers.py` alongside file export. • Adds extra-PAC implementation in `ticketer.py`. • Adds callback function for incoming authentications in `smbserver` library. Breaking changes: • Ticket duration in `ticketer.py` is now specified in hours instead of days. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_10_0 https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_10_0 Wed, 04 May 2022 14:55:44 GMT impacket 0.10.0 adds new scripts (machine_role.py, keylistattack.py), protocol implementations ([MS-DSSP], CCache v3), and attack modules to ntlmrelayx.py and secretsdump.py • Adds `machine_role.py` script to retrieve a host's role along with its primary domain details • Adds `keylistattack.py` example implementing the Kerberos Key List attack for dumping credentials via RODCs and Azure AD Kerberos Servers • Adds [MS-DSSP] protocol implementation in the library • Adds support for loading CCache Version 3 in the Credential Cache • Adds GetDriverDirectory functions to [MS-PAR] and [MS-RPRN] • Adds a function to compute the Netlogon Authenticator at client-side in [MS-NRPC] • Adds StartTLS support to `ntlmrelayx.py` • Adds multiple HTTP listeners capability to `ntlmrelayx.py` • Adds the ability to define a password for the LDAP attack addComputer in `ntlmrelayx.py` • Adds rename_computer and modify add_computer functionality in the LDAP interactive shell of `ntlmrelayx.py` • Adds Shadow Credentials attack support to `ntlmrelayx.py` • Adds support for ADCS ESC1 and ESC6 attacks in `ntlmrelayx.py` • Adds an option to disable the multi-relay feature in `ntlmrelayx.py` • Adds a multi-relay feature to the HTTP Relay Server in `ntlmrelayx.py` allowing one HTTP connection against multiple targets • Adds an LDAP attack dumping information about ADCS enrollment services in `ntlmrelayx.py` • Implements RAW Relay Server in `ntlmrelayx.py` • Adds a save function to `reg.py` to allow remote saving of registry hives • Adds secretsdump.py option to dump credentials using the Kerberos Key List attack • Adds an option to smbpasswd.py to force credentials change via injecting new values into SAM Breaking changes: • Dropped support for Python 2.7 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/fortra/impacket/blob/master/ChangeLog.md https://github.com/fortra/impacket/blob/master/ChangeLog.md Sun, 01 May 2022 00:00:00 GMT Impacket v0.10.0 adds [MS-DSSP], Key List attack examples, ADCS/Shadow Credentials in ntlmrelayx • Adds `[MS-DSSP]` protocol implementation to the library Breaking changes: • Dropped support for Python 2.7. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_9_24 https://github.com/SecureAuthCorp/impacket/releases/tag/impacket_0_9_24 Wed, 27 Oct 2021 15:29:39 GMT impacket 0.9.24 adds rbcd.py for RBCD attacks and new features to ntlmrelayx.py • Adds `rbcd.py` example script to handle the `msDS-AllowedToActOnBehalfOfOtherIdentity` property • Adds `getST.py` support for a custom additional ticket in S4U2Proxy scenarios • Adds `ntlmrelayx.py` Negotiate authentication support to its HTTP server • Adds `smbclient.py` 'mget' command to download multiple files from a share • Adds `smbpasswd.py` ability to change a user's password by providing NTLM hashes • Adds `reg.py` ADD and DELETE functionalities for remote registry modification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/impacket