Impacket Tool in Kali Repo Upgraded With New Attack Paths and Relay Tricks
The Impacket toolkit, an essential tool in penetration testing and integrated into the Kali Linux repository, is scheduled for a significant update.
The Impacket toolkit, an essential tool in penetration testing and integrated into the Kali Linux repository, is scheduled for a significant update.
Managed by Fortra's cybersecurity team, the upcoming release, succeeding version 0.12, introduces enhanced relay capabilities, protocol hardening, and new scripting tools in response to community feedback.
This update aims to improve red team operations in modern Windows environments, facilitating navigation through complex Active Directory setups and relay attacks.
Key enhancements include updates to ntlmrelayx.py , transforming it into a versatile relay operator. This allows security researchers to serve SCCM Management Points and Distribution Points directly, enabling the enrollment of unauthorized clients to access secret policies or examine packages for sensitive information.
The update also introduces a new RPC listener and EPM bootstrapper, simplifying the transition from printer bugs to ADCS exploitation, thereby condensing multi-step attacks into single commands.
The Impacket toolkit, an essential tool in penetration testing and integrated into the Kali Linux repository, is scheduled for a significant update.
Additional features include a WinRM relay target that forwards inbound NTLM authentications from sources like SMBv1, LDAP, HTTP, or captured hashes to generate interactive shells via local TCP ports.
The SOCKS proxy plugin now supports LDAP and LDAPS traffic, allowing seamless integration with existing tools without the need for custom rewrites. Logging improvements provide detailed insights into coerced victims by linking attacks to specific relayed connections.
Protocol Hardening and Workflow Enhancements
The Impacket update strengthens channel binding and signing across LDAP, Kerberos, and SQL protocols to counter evolving defenses. SASL enhancements ensure compatibility with domains requiring unsigned binds, while a reworked TDS handshake in mssqlclient.py handles encryption and CBT natively, eliminating the need for external dependencies like PyOpenSSL.
Further enhancements to MSSQL workflows include richer version banners for scripting, fixed uploads on non-English systems, and new CLI command inputs for mssqlclient.py . SMB refactoring addresses sharing violations during live file copies, such as event logs, and refines signing to imitate native Windows behavior.
The release introduces new examples, such as badsuccessor.py for dMSA object manipulation, enabling inventory and exploitation of vulnerable organizational units.
Other additions include attrib.py and filetime.py for file metadata control, regsecrets.py for remote hive extraction, CheckLDAPStatus.py for auditing signing enforcement, and samedit.py for offline SAM editing.
Standardized logging and authentication parsing across examples minimize boilerplate, with secretsdump.py gaining remote WMI options for NTDS.dit dumps. As Impacket is incorporated into Kali repositories, testers are encouraged to experiment in labs with recent Windows builds.
Based on reporting by Cyber Security News.