Protocols and Library Modules

Back to the Command Index

These pages trace technologies used across commands, from the underlying communication and data formats to Impacket’s implementation. For example, the Kerberos page first covers ticket exchanges, then explains functions and key handling in impacket/krb5/. The command pages cover the behavior and branches of each CLI, while the Active Directory guides cover authentication and operations on the Windows side.

The current code is the authority for its implementation. Microsoft’s published specifications ([MS-SMB2], [MS-NLMP], [MS-KILE], [MS-RPCE], [MS-PAC], and others) provide background, but these pages identify features Impacket does not implement and places where it deliberately simplifies the specification.

Reading Order

1. Structure and the Binary DSL — the basis for almost every PDU
2. The page for the protocol of interest
3. The command pages that use that protocol

flowchart TB
    CLI["examples/*.py"] --> Shared["impacket.examples.*"]
    CLI --> High["High-level sessions"]
    Shared --> High
    High --> SMB["smbconnection / smb / smb3"]
    High --> LDAP["ldap.ldap"]
    High --> KRB["krb5.kerberosv5"]
    High --> RPC["dcerpc.v5.transport"]
    High --> TDS["tds.MSSQL"]
    SMB --> NTLM["ntlm / spnego"]
    LDAP --> NTLM
    LDAP --> KRB
    RPC --> NTLM
    RPC --> KRB
    TDS --> NTLM
    TDS --> KRB
    SMB --> Struct["structure.Structure"]
    RPC --> NDR["dcerpc.v5.ndr"]
    NDR --> Struct
    NTLM --> Struct

Technology Pages

Page	Target Modules	Main Command Categories
Structure	structure.py	General
SMB / NetBIOS	nmb, smb, smb3, smb3structs, smbconnection, smbserver	SMB-RPC, RemoteExecution
NTLM / SPNEGO / NEGOEX	ntlm, spnego, negoex	SMB-RPC
Kerberos	krb5.*	Kerberos
DCE/RPC and NDR	dcerpc.v5.*	SMB-RPC, RemoteExecution, ActiveDirectory
LDAP and AD Security Descriptors	ldap.*, ldaptypes, msada_guids	ActiveDirectory
DPAPI / SAM / LSA / NTDS	dpapi, dpapi_ng, winregistry, ese, examples.secretsdump	Secrets-Storage
TDS / MQTT / Exchange	tds, mqtt, dcerpc.v5.nspi	Database-Messaging
Packets / Registry / ESE / NTFS	ImpactPacket, ImpactDecoder, IP6*, ese, winregistry	Network-Packets, Secrets-Storage

Differences Between Specification and Implementation

Impacket implements the portions needed for research and testing, not every part of the specifications. In particular, changing code based only on a specification can break the following behavior.

• Both SMB2 and SMB3 client implementations are in smb3.py.
• NTLMv2 is selected by the local USE_NTLMv2 setting, not a negotiation bit.
• S4U2self / S4U2proxy / U2U are mainly in examples/getST.py, not krb5.kerberosv5.
• impacket.acl handles SMB/NTFS file ACLs, not the AD nTSecurityDescriptor.
• SimpleSMBServer accepts SMB 2.0.2, 2.1, and 3.1.1. It does not offer SMB 3.0 or 3.0.2.