Impacket changepasswd.py

Back to the Category Index / Back to the Command Index

Overview

Changes a user’s own password or performs an administrator reset through Kerberos kpasswd, SAMR, or LDAP.

Item	Details
Implementation	examples/changepasswd.py
Category	Active Directory / LDAP / Account Management
Size	975 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/changepasswd.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]<hostname or address>
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-newpass	New password.
-newhashes	New NTLM hashes in NTHASH or LMHASH:NTHASH format.
-hashes	NTLM hashes in NTHASH or LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with Kerberos -k).
-altuser	Alternative username
-altpass	Alternative password
-althash / -althashes	Alternative NT hash in NTHASH or LMHASH:NTHASH format.
-protocol / -p	Protocol for password change or reset. Choices: smb-samr, rpc-samr, kpasswd, ldap. Default: smb-samr.
-reset / -admin	Attempt an administrator password reset (may bypass some password policies).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller IP address for Kerberos. Defaults to the domain (FQDN) in the target parameter.

Detailed Processing Flow

parse_args() validates the target credentials, new password/hash, and alternate administrator credentials. -protocol selects KPassword, SmbPassword, RpcPassword, or LdapPassword. The shared PasswordHandler interface separates change from set; each backend handles authentication, target resolution, and protocol-specific requests.

How It Works

Changing a password and resetting it are separate operations. A change normally proves the target user’s old credentials before moving to a new value. A reset sets the target account’s value using the privileges of another principal, such as an administrator. PasswordHandler separates them into changePassword() and setPassword(), and each backend implements the corresponding wire operation.

The Kerberos backend sends a request with an AP-REQ to the kpasswd service. The SAMR backend chooses a user handle and password method over an SMB named pipe or TCP RPC. The LDAP backend finds the target DN and converts the action to a unicodePwd modify on a TLS-protected connection. Which backends accept a password or NT hash and whether old credentials are required vary by backend.

The -altuser options separate the actor from the target. Overwriting these as one credential set breaks the distinction between reset and self-change. Password policy violations, wrong old passwords, access denied, and missing secure channels call for different responses; preserve protocol-specific status upstream.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
PasswordHandler	137	__init__(), changePassword(), setPassword()
KPassword	251	Structure and constant definitions
SamrPassword	321	rpctransport(), authenticate(), connect(), hSamrOpenUser(), hSamrUnicodeChangePasswordUser2(), hSamrChangePasswordUser(), hSamrSetInformationUser()
RpcPassword	566	rpctransport()
SmbPassword	591	rpctransport()
LdapPassword	596	connect(), encodeLdapPassword(), findTargetDN()
parse_args()	743	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.dcerpc.v5	epm, samr, transport
impacket.krb5	kerberosv5, kpasswd
impacket.ldap	ldap, ldapasn1
impacket.examples	logger
impacket.examples.utils	EMPTY_LM_HASH, parse_target

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
OpenSSL	pyOpenSSL	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

• Some operations change the target’s state. Confirm the target name, SID, and path before making changes.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on krb5.kpasswd / kerberosv5, dcerpc.v5.samr, ldap / ldapasn1, and OpenSSL. Reset and change require different privileges and wire operations; do not conflate them in shared code.

Verification

• Syntax: python -m py_compile examples/changepasswd.py
• CLI: python examples/changepasswd.py -h
• Related test: tests/SMB_RPC/test_ldap.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py
• Related test: tests/misc/test_krb5_crypto.py
• Related test: tests/misc/test_krb5_gssapi.py