Impacket regsecrets.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Retrieves SAM hashes, LSA secrets, and cached credentials through Remote Registry. It does not target NTDS.
| Item | Details |
|---|---|
| Implementation | examples/regsecrets.py |
| Category | Secrets / DPAPI / registry / file analysis |
| Size | 251 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/regsecrets.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | [[domain/]username[:password]@] |
-ts | Add a timestamp to each log message |
-debug | Enable debug output |
-system | SYSTEM hive to parse |
-bootkey | Boot key for the SYSTEM hive |
-nosam | Do not retrieve SAM information |
-nocache | Do not retrieve MSCache information |
-nolsa | Do not retrieve LSA secrets |
-throttle | Delay in seconds between operations |
-outputfile | Base output filename; extensions are added for SAM, secrets, and cached credentials |
-history | Dump password history (NTDS and SAM hashes) and LSA secret OldVal values |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-no-pass | Do not prompt for a password (useful with -k) |
-k | Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line |
-aesKey | AES key for Kerberos authentication (128 or 256 bits) |
-keytab | Read SPN keys from a keytab file |
-dc-ip | Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter |
-target-ip | Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved |
Detailed processing flow
Section titled “Detailed processing flow”After connecting over SMB, RemoteOperations prepares access to the boot key and registry data. The tool prefers a supplied SYSTEM hive or boot key, then runs SAMHashes and LSASecrets according to the options and handles history and output files. Finally, it cleans up temporary hives, RemoteRegistry state, and connections.
How it works
Section titled “How it works”Decrypting SAM and LSA secrets requires a boot key specific to the target machine.
DumpSecrets creates an SMB session, and RemoteOperations reconstructs the boot
key from LSA class data in the SYSTEM hive. If an explicit -bootkey or local
SYSTEM file is available, it switches to a path that avoids remote retrieval.
SAMHashes derives the SAM domain account encryption key from the boot key and
uses each user’s RID to decrypt LM and NT hash fields. LSASecrets derives the
SECURITY policy key and decrypts LSA secrets and cached domain logon records
according to their versions and algorithms. SAM and the LSA cache do not use
the same encryption format, even within the same hive.
Remote retrieval may use the Registry service and temporary hive or file access.
-nosam, -nocache, and -nolsa should skip unnecessary remote operations as
well as their decoders. Output files contain secrets, so identify what was saved
on partial success and restore service state and temporary resources in cleanup().
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
DumpSecrets | 66 | __init__(), connect(), dump(), cleanup() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket.smbconnection | SMBConnection |
impacket.examples.regsecrets | LSASecrets, RemoteOperations, SAMHashes |
impacket.krb5.keytab | Keytab |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
- Options may create or update local files. Check how existing files are handled and the permissions on output containing secrets.
- Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after an abnormal exit is part of the behavior contract.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
- Cleanup-related methods include
cleanup(). Check that new early returns and exception paths reach it too.
When changing the implementation
Section titled “When changing the implementation”The code depends on SMBConnection, RemoteOperations, SAMHashes, and LSASecrets from impacket.examples.regsecrets, plus keytabs. CLI class DumpSecrets handles orchestration rather than decoding secrets itself.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/regsecrets.py - CLI:
python examples/regsecrets.py -h - No test specific to this command was found. Choose shared-module tests and, if needed, a run in an isolated environment.