impacket-programming-manual

The impacket Programming Manual · impacket 编程手册（域渗透脚本开发）

Stop copy-pasting impacket examples — learn to write your own PoC against the Kerberos / RPC / DCOM stack.

About · What's inside · Highlights · Getting started · Repo layout · Contributing · Disclaimer

🌐 中文版

About

impacket-programming-manual is a book-length, source-code-driven guide to developing your own domain-penetration scripts on top of impacket — not another walkthrough of secretsdump.py / psexec.py flags.

Almost every public exploit for recent Active Directory vulnerabilities was built directly on impacket modules — sam-the-admin, CVE-2022-33679, noPac, Zerologon tooling, PetitPotam-style relay chains… Yet nearly all existing articles only explain how to run the example scripts. This manual fills the gap the other way around: it walks module by module through the impacket source tree, so when the next domain vulnerability drops you can grab impacket and write your own PoC fast.

• Author: Lu Ping (鲁平) · WeChat blog: IndexSec
• Length: ~5,400 lines, 9 chapters, 6 parts — with an English edition translated from the revised Chinese 2nd edition
• Covers: LDAP · Kerberos (krb5) · GSS-API/SPNEGO · DCE/RPC (NDR, EPM, transport) · 20+ MS protocol modules (SAMR, NRPC, LSAD, RRP, SRVS, RPRN/PAR, TSCH, BKRP, DRSUAPI…) · DCOM & WMI (dcomrt, oaut, comev, scmp, vds, wmi) · the common support libraries · the impacket 0.12–0.14 additions: ICPR (AD CS certificate enrollment), GKDI (group key distribution), NEGOEX (SPNEGO extended negotiation), RAA (remote authorization), SCMR, plus the acl.py and dpapi_ng.py helpers

What's inside

Part	Chapter	Content	Prerequisites
I. Preliminaries	Ch.1 impacket overview & directory layout	Where every module lives in the source tree	none
	Ch.2 structure.py — universal serialization base	The base class behind every protocol packet structure	none
II. Authentication & Directory	Ch.3 LDAP (ldap)	Directory queries, ACL structures, Global Catalog	Ch.2
	Ch.4 Kerberos (krb5)	Tickets, ccache/keytab, PAC, GSS-API & SPNEGO	Ch.2
III. DCE/RPC	Ch.5 dcerpc	RPC basics (NDR, rpcrt, EPM, transport) + 20+ interface modules in 5 functional groups	Ch.2, 4
IV. DCOM & WMI	Ch.6 MS-DCOM	COM/DCOM programming, dcomrt, oaut/comev/scmp/vds/wmi submodules	Ch.5
V. Support libraries	Ch.7 common	SMB2/3, DPAPI, NTDS (ese), TDS and friends	as needed
VI. New interfaces & case studies	Ch.8 interfaces & support libraries added in 0.12–0.14	ICPR · GKDI · NEGOEX · RAA · SCMR · acl.py · dpapi_ng.py	Ch.2, 5
	Ch.9 case studies	BadSuccessor (CVE-2025-53779) and CVE-2025-33073 — PoC walk-throughs	Ch.3, 5

Case studies woven through the chapters: Zerologon (CVE-2020-1472) in nrpc, PrinterBug / PrintNightmare in rprn/par, CVE-2019-1040 NTLM MIC bypass in gssapi, Exchange RPC-over-HTTP relay (rpcmap / ProxyRelay), Akamai's Cold Hard Cache RPC security-callback bypass, WMI persistence (wmipersist), golden PAC forging — and, in the added Part VI, BadSuccessor (CVE-2025-53779), which abuses the Windows Server 2025 dMSA account type, and CVE-2025-33073, the reflective relay that yields SYSTEM on any host without SMB signing.

Highlights

• Source-level, not example-level — every chapter reads the actual impacket source: getKerberosTGT/getKerberosTGS internals, ccache/keytab binary layouts, DCERPCTransportFactory dispatch, DCOMConnection/INTERFACE/IRemUnknown object model, IWbemServices method tables.
• Annotated code excerpts — long listings are compressed to key code paths with step-numbered annotations (① ② ③… in Chinese, (1) (2) (3)… in English), so you see the flow at a glance instead of scrolling through hundreds of lines of boilerplate.
• Upstream-verified quotes — all cited code was checked against the current fortra/impacket master; known upstream quirks (the par.py opnum 39 tuple, hept_map spelling, MimiUnbind vs MiniUnbind) are preserved and annotated instead of silently "fixed".
• Descriptive TOC — every module heading carries a content summary (### nrpc.py — Netlogon Authentication & Zerologon (CVE-2020-1472)), not just a bare filename.
• Fully bilingual — the English edition's code blocks carry zero CJK characters; all annotations and method descriptions are translated.
• Kept current with upstream — Part VI tracks impacket 0.12–0.14 (ICPR, GKDI, NEGOEX, RAA, SCMR, acl.py, dpapi_ng.py) and the recent attack surface (BadSuccessor, CVE-2025-33073); the interfaces with no upstream example get a runnable PoC under example/.

Getting started

git clone https://github.com/lupingQAQ/impacket-programming-manual.git

• Read online: impacket编程手册.md (中文) / impacket_programming_manual_EN.md (English)
• Offline reading: grab impacket编程手册.pdf or impacket_programming_manual_EN.pdf
• Recommended path: follow the Reading Guide table at the top of the manual — foundations (Ch.1–2) → Kerberos (Ch.4) → pick RPC interface modules by functional group (Ch.5)
• Practice environment: a Windows AD lab (e.g. two VMs + pip install impacket), then re-implement the case studies module by module
• Runnable PoCs: the example/ folder ships four scripts for the Part VI interfaces that upstream has no standalone example for — certificate enrollment (ICPR), GKDI key fetch, NEGOEX parsing, and RAA permission enumeration. For SCMR, SMB ACLs, DPAPI-NG and BadSuccessor, use impacket's own examples/services.py, smbclient.py, GetLAPSPassword.py and badsuccessor.py

Repository layout

.
├── README.md                         # This file (English, default)
├── README.zh-CN.md                   # 中文版说明
├── impacket编程手册.md                # Chinese edition (source of truth)
├── impacket编程手册.pdf               # Chinese print edition
├── impacket_programming_manual_EN.md # English edition
├── impacket_programming_manual_EN.pdf # English print edition
├── example/                          # runnable PoCs for the Part VI interfaces
└── docs/                             # mkdocs source (bilingual docs site)

Contributing

Corrections are very welcome — especially:

1. Technical review against impacket / Microsoft protocol documentation (function names, flows, crypto descriptions)
2. New chapter material (e.g. ADCS, ntlmrelayx internals, smbconnection deep-dive)
3. Translation improvements for the English edition

Fork → branch → PR. Typos and citation fixes are just as appreciated.

Contact: WeChat blog IndexSec · GitHub Issues

Disclaimer

This manual is provided for lawful security research, education, and authorized penetration testing only. All techniques discussed target protocols and systems in lab environments you own or are explicitly authorized to assess. The author and contributors accept no liability for misuse.

(back to top)