Impacket GetLAPSPassword.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Reads legacy LAPS and Windows LAPS attributes from LDAP. It retrieves GKDI keys to decrypt encrypted Windows LAPS passwords.
| Item | Details |
|---|---|
| Implementation | examples/GetLAPSPassword.py |
| Category | Active Directory / LDAP / Account Management |
| Size | 299 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/GetLAPSPassword.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | domain[/username[:password]] |
-computer | Target a specific computer by name. |
-ts | Add timestamps to log output. |
-debug | Enable debug logging. |
-outputfile / -o | Write output to a file. |
-hashes | NTLM hashes in LMHASH:NTHASH format. |
-no-pass | Skip the password prompt (useful with -k). |
-k | Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid. |
-aesKey | 128- or 256-bit AES key for Kerberos authentication. |
-dc-ip | Domain controller IP address. Defaults to the domain (FQDN) in target. |
-dc-host | Domain controller hostname. Defaults to the domain (FQDN) in the account parameter. |
-ldaps / -use-ldaps | Use LDAPS instead of LDAP. |
Related technology: LDAP and DPAPI-NG / GKDI in DPAPI / SAM / LSA / NTDS.
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command searches LDAP for computer objects and LAPS attributes, formatting plaintext attributes directly. For encrypted attributes, it decodes the CMS blob as ASN.1, connects to GKDI through the RPC Endpoint Mapper, derives the KEK/CEK from the group key, and decrypts the DPAPI-NG payload. Results go to a table or the file specified by -o.
How It Works
Section titled “How It Works”Legacy LAPS and Windows LAPS return different kinds of LDAP values. Legacy
LAPS attributes return the password directly if the reader has permission.
Encrypted Windows LAPS attributes contain a CMS envelope and DPAPI-NG metadata;
an LDAP search alone cannot produce plaintext. run() first enumerates
computers and attributes, then separates plaintext and encrypted paths by attribute format.
For encrypted values, the command parses EncryptedPasswordBlob and CMS ASN.1,
identifies the required GKDI group key from the blob’s key identifier, then
finds the GKDI RPC endpoint through the Endpoint Mapper. As an authorized caller,
it retrieves key material, derives a KEK with a KDF, and decrypts the wrapped
CEK followed by the ciphertext. This crosses several protocol boundaries:
LDAP → ASN.1/CMS → GKDI RPC → DPAPI-NG.
Decryption may fail because the attribute cannot be read, GKDI access is denied,
the key generation ID does not match, or the blob is damaged. In getLAPSv2Decrypt(),
keeping track of the stage reached, rather than collapsing these into one
generic error, makes maintenance easier. In JSON and table output, keep the
password associated with its computer and expiration time.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
GetLAPSPassword | 41 | __init__(), printTable(), getLAPSv2Decrypt(), getUnixTime(), run() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket | version |
impacket.dcerpc.v5 | transport |
impacket.dcerpc.v5.epm | hept_map |
impacket.dcerpc.v5.gkdi | GkdiGetKey, GroupKeyEnvelope, MSRPC_UUID_GKDI |
impacket.dcerpc.v5.rpcrt | RPC_C_AUTHN_LEVEL_PKT_INTEGRITY, RPC_C_AUTHN_LEVEL_PKT_PRIVACY |
impacket.dpapi_ng | EncryptedPasswordBlob, KeyIdentifier, compute_kek, create_sd, decrypt_plaintext, unwrap_cek |
impacket.examples | logger |
impacket.examples.utils | ldap_login, parse_identity |
impacket.ldap | ldap, ldapasn1 |
External Packages (Direct Use)
Section titled “External Packages (Direct Use)”| Import Name | Distribution Package | Usage / Declaration Status |
|---|---|---|
pyasn1 | pyasn1 | Imported directly; declared dependency |
pyasn1_modules | pyasn1_modules | Imported directly; declared dependency |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
- Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
When Changing the Implementation
Section titled “When Changing the Implementation”This command uses ldap / ldapasn1, dcerpc.v5.gkdi, dpapi_ng, pyasn1, and pyasn1_modules.rfc5652. getLAPSv2Decrypt() is the boundary between LDAP and RPC and the central point for changes to the encryption format.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/GetLAPSPassword.py - CLI:
python examples/GetLAPSPassword.py -h - Related test:
tests/SMB_RPC/test_ldap.py - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/dcerpc/test_epm.py - Related test:
tests/misc/test_dcerpc_v5_ndr.py