Impacket is a collection of Python classes focused on providing access to network packets. Impacket allows Python developers to craft and decode network packets in simple and consistent manner. It includes support for low-level protocols such as IP, UDP and TCP, as well as higher-level protocols such as NMB,SMB and MSRPC (a.k.a. DCERPC). Impacket is highly effective when used in conjunction with a packet capture utility or package such asĀ Pcapy. Packets can be constructed from scratch, as well as parsed from raw data. Furthermore, the object oriented API makes it simple to work with deep protocol hierarchies.
The following protocols are featured in Impacket
Ethernet, Linux "Cooked" capture.
IP, TCP, UDP, ICMP, IGMP, ARP.
NMB and SMB1/2/3 (high-level implementations).
DCE/RPC versions 4 and 5, over different transports: UDP (version 4 exclusively), TCP, SMB/TCP, SMB/NetBIOS and HTTP.
Multiple ways of doing SMB tree_connect, file open, read, write.
SMB "fragmentation", SMB AndX command chaining.
Plain, NTLM v1/v2 authentications, using password and hashes only.
Portions/full implementation of the following DCE/RPC interfaces: EPM, DTYPES, LSAD, LSAT, NRPC, RRP, SAMR, SRVS, WKST, SCMR
DCERPC Alternate contexts, Multi-bind requests, Endianness selection
DCERPC NTLM v1/v2 and NETLOGON authentication, integrity checking and encryption.
DCERPC v4 and v5 fragmentation, DCERPC v4 idempotent requests.
Take a look atĀ this documentĀ for an explanation of the advanced SMB and DCERPC features(outdated for the current version :-/)