Impacket samrdump.py

Back to the Category Index / Back to the Command Index

Overview

Retrieves users and account details from a target host or domain through SAMR and prints them as a table or CSV.

Item	Details
Implementation	examples/samrdump.py
Category	Active Directory / LDAP / Account Management
Size	256 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/samrdump.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]<targetName or address>
-csv	Enable CSV output.
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-dc-ip	Domain controller IP address. Defaults to the domain (FQDN) in target.
-target-ip	Target machine IP address. Defaults to target; useful when the target is a NetBIOS name that cannot be resolved.
-port	Destination SMB server port (choices: 139, 445; default: 445).
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.

Detailed Processing Flow

The command connects to the SAMR named pipe, opens server and domain handles, and enumerates users in pages. It then retrieves details for each RID, converts last logon and password timestamps, and displays the results.

How It Works

SAMR user enumeration does not return all user details at once. dump() first opens server and domain handles, then receives RID and account-name lists in pages from EnumerateUsersInDomain. It opens a user handle for each RID and retrieves additional attributes with QueryInformationUser.

STATUS_MORE_ENTRIES is a continuation marker, not a failure. Pass the resume handle into the next request and collect pages through the last one. If a query for one user is denied, retain the other enumerated users and identify which RID lacks details.

Account timestamps are converted from Windows time and must mean the same thing in CSV and table output. CSV is machine-readable, so avoid casually changing blank display values, delimiters, or character encoding. The chosen domain handle determines whether users belong to the domain or local SAM.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
ListUsersException	36	Structure and constant definitions
SAMRDump	39	__init__(), getUnixTime(), dump()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket.examples	logger
impacket.examples.utils	parse_target
impacket	version
impacket.nt_errors	STATUS_MORE_ENTRIES
impacket.dcerpc.v5	samr, transport
impacket.dcerpc.v5.rpcrt	DCERPCException

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command depends on dcerpc.v5.samr / transport and STATUS_MORE_ENTRIES. SAMRDump.dump() and getUnixTime() are its main implementation points. Treat pagination status as a continuation, not an error, and retain already retrieved records.

Verification

• Syntax: python -m py_compile examples/samrdump.py
• CLI: python examples/samrdump.py -h
• Related test: tests/SMB_RPC/test_rpcrt.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py