Impacket net.py

Back to the Category Index / Back to the Command Index

Overview

Uses SAMR to query and change users and groups, much like Windows net user and net group.

Item	Details
Implementation	examples/net.py
Category	Active Directory / LDAP / Account Management
Size	589 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/net.py -h for the current option definitions.

Subcommands: user, computer, localgroup, group

Argument	Description
target	[[domain/]username[:password]@]<targetName or address>
-debug	Enable debug logging.
-ts	Add timestamps to log output.
-name	Display information about one user.
-create	Add a user account to the domain or computer.
-remove	Remove a user account from the domain or computer.
-newPasswd	Password to set when creating an account.
-enable	Enable the account.
-disable	Disable the account.
-join	Add a user account to a specified group.
-unjoin	Remove a user account from a specified group.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller IP address. Defaults to the domain (FQDN) in target.
-target-ip	Target machine IP address. Defaults to target; useful when the target is a NetBIOS name that cannot be resolved.
-port	Destination SMB server port (choices: 139, 445; default: 445).

Detailed Processing Flow

The command connects to SAMR/LSA over SMB transport and selects User, Computer, Group, or Localgroup from the subcommand. After resolving object RIDs/SIDs and handles, it enumerates, creates, deletes, enables, or joins/unjoins groups as requested, then closes handles and connections.

How It Works

The command offers an interface similar to Windows net, but operates directly on the SAMR object model. It first resolves the server handle, domain SID, and domain handle, then resolves RIDs and opens object handles for the user, computer, group, or localgroup subcommand. Resolving a name to a RID and reading details from that RID are separate RPC calls.

User and Computer handle account creation, deletion, queries, passwords, and UAC changes. Group handles domain groups; Localgroup handles aliases, so membership operations use different SAMR APIs and SID scopes. LsaTranslator converts between names and SIDs for display and member selection, separately from SAMR operations.

RPC handles have parent-child relationships. Open user, group, and domain handles must be closed even after an intermediate failure. Enumeration may take more than one request, so continuation status is part of the normal path. For a new subcommand, follow the existing object class boundaries for name resolution, handle acquisition, operations, and handle closure.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
LsaTranslator	49	__init__(), Connect(), LookupName(), LookupSids()
SamrObject	76	__init__()
User	141	__init__(), Enumerate(), Query(), Create(), Remove(), SetUserAccountControl()
Computer	247	__init__()
Group	254	Enumerate(), Query(), Join(), UnJoin()
Localgroup	296	Enumerate(), Query(), Join(), UnJoin()
Net	338	__init__(), connect(), disconnect(), run()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.examples	logger
impacket.examples.utils	parse_target
impacket.dcerpc.v5	lsad, lsat, samr, transport
impacket.smbconnection	SMBConnection

Output, Side Effects, and Required Privileges

• Some operations change the target’s state. Confirm the target name, SID, and path before making changes.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
• _close_domain() and disconnect() handle cleanup. Check that new early returns and exception paths still reach them.

When Changing the Implementation

This command uses dcerpc.v5.samr / lsad / lsat / transport and SMBConnection. SamrObject handles common handle operations, while LsaTranslator converts between SIDs and names.

Verification

• Syntax: python -m py_compile examples/net.py
• CLI: python examples/net.py -h
• Related test: tests/ImpactPacket/test_ethernet.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py