Impacket GetNPUsers.py
Back to the Category Index / Back to the Command Index
Overview
Section titled “Overview”Finds accounts that do not require pre-authentication through LDAP. It can also request AS-REPs and save them in a format for offline analysis.
| Item | Details |
|---|---|
| Implementation | examples/GetNPUsers.py |
| Category | Kerberos / Ticket Handling |
| Size | 411 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and Inputs
Section titled “CLI and Inputs”Check python examples/GetNPUsers.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]] |
-request | Request TGTs for users and output them in JtR/hashcat format (default: false). |
-outputfile | File for ciphertexts in JtR/hashcat format. |
-format | Format for saving the AS_REQ of users without pre-authentication (choices: hashcat, john; default: hashcat). |
-usersfile | File with one user per line to test. |
-ts | Add timestamps to log output. |
-debug | Enable debug logging. |
-hashes | NTLM hashes in LMHASH:NTHASH format. |
-no-pass | Skip the password prompt (useful with -k). |
-k | Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid. |
-aesKey | 128- or 256-bit AES key for Kerberos authentication. |
-dc-ip | Domain controller IP address. Defaults to the domain (FQDN) in target. |
-dc-host | Domain controller hostname. Defaults to the domain (FQDN) in the account parameter. |
-ldaps / -use-ldaps | Use LDAPS instead of LDAP. |
Detailed Processing Flow
Section titled “Detailed Processing Flow”The command connects to LDAP using a domain identity and selects users with UF_DONT_REQUIRE_PREAUTH. With -request, it builds an AS-REQ for each user, sends it to the KDC, and converts the encrypted part of the AS-REP to the chosen format. -usersfile skips the LDAP search and tries input names in order.
How It Works
Section titled “How It Works”For ordinary accounts with Kerberos pre-authentication enabled, the client
includes a timestamp encrypted with the user’s key in the AS-REQ. The KDC
validates it before returning a TGT. For accounts with
UF_DONT_REQUIRE_PREAUTH, the KDC can return an AS-REP without this proof,
allowing the encrypted response part to be saved for offline verification. The command combines the directory search and KDC requests.
The LDAP path searches UAC flags and account state and lists candidate users.
It builds an AS-REQ for each principal only when -request is set.
The -usersfile path needs no LDAP read permission and queries the KDC
directly for supplied principals. Responses differ for nonexistent users,
required pre-authentication, and rate limits.
getTGT() decodes AS-REP/KRB-ERROR with ASN.1 and changes where it splits
the ciphertext and how it formats output according to the enctype.
Hashcat and John use different field orders and separators, so the same
bytes cannot simply be converted to hex. Do not treat every KDC error as
“target absent”; distinguish clock skew, unknown principals, and required pre-authentication.
Key Implementation Elements
Section titled “Key Implementation Elements”| Symbol | Location | Entry Point for Tracing Behavior |
|---|---|---|
GetUserNoPreAuth | 50 | __init__(), printTable(), getUnixTime(), getTGT(), outputTGT(), run(), request_users_file_TGTs(), request_multiple_TGTs() |
Dependencies
Section titled “Dependencies”Internal Impacket Modules
Section titled “Internal Impacket Modules”| Module | Main Names Used |
|---|---|
impacket | version |
impacket.dcerpc.v5.samr | UF_ACCOUNTDISABLE, UF_DONT_REQUIRE_PREAUTH |
impacket.examples | logger |
impacket.examples.utils | ldap_login, parse_identity |
impacket.krb5 | constants |
impacket.krb5.asn1 | AS_REP, AS_REQ, KERB_PA_PAC_REQUEST, KRB_ERROR, seq_set, seq_set_iter |
impacket.krb5.kerberosv5 | KerberosError, sendReceive |
impacket.krb5.types | KerberosTime, Principal |
impacket.ldap | ldap, ldapasn1 |
External Packages (Direct Use)
Section titled “External Packages (Direct Use)”| Import Name | Distribution Package | Usage / Declaration Status |
|---|---|---|
pyasn1 | pyasn1 | Imported directly; declared dependency |
Output, Side Effects, and Required Privileges
Section titled “Output, Side Effects, and Required Privileges”- Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.
- Depending on options, creates or updates a local file. Check how existing files are handled and the permissions on output containing secrets.
Failure Paths and Cleanup
Section titled “Failure Paths and Cleanup”- On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
When Changing the Implementation
Section titled “When Changing the Implementation”This command uses krb5.asn1 / constants / kerberosv5 / types, pyasn1, and LDAP helpers. getTGT(), outputTGT(), and the methods for requesting multiple users mark the boundary between search and KDC I/O.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/GetNPUsers.py - CLI:
python examples/GetNPUsers.py -h - Related test:
tests/SMB_RPC/test_ldap.py - Related test:
tests/dcerpc/test_samr.py - Related test:
tests/misc/test_krb5_crypto.py - Related test:
tests/misc/test_krb5_gssapi.py