Impacket Craft and decode network packets in a simple and consistent manner
Download

Impacket Ranking & Summary

Impacket Tags

decode connect divide smb connection decode packet divide packet

Impacket Description

Craft and decode network packets in a simple and consistent manner Impacket is a collection of Python classes focused on providing access to network packets. Impacket allows Python developers to craft and decode network packets in simple and consistent manner. Impacket includes support for low-level protocols such as IP, UDP and TCP, as well as higher-level protocols such as NMB and SMB. Impacket is highly effective when used in conjunction with a packet capture utility or package such as Pcapy. Packets can be constructed from scratch, as well as parsed from raw data. Furthermore, the object oriented API makes it simple to work with deep protocol hierarchies.The following protocols are featured in Impacket· Ethernet, Linux "Cooked" capture.· IP, TCP, UDP, ICMP, IGMP, ARP.· NMB and SMB (high-level implementations).· DCE/RPC versions 4 and 5, over different transports: UDP (version 4 exclusively), TCP, SMB/TCP, SMB/NetBIOS and HTTP.· Multiple ways of doing SMB tree_connect, file open, read, write.· SMB "fragmentation", SMB AndX command chaining.· Plain, NT and LM v1 authentications, using password and hashes only.· Portions of the following DCE/RPC interfaces: Conv, DCOM, EPM, SAMR, SvcCtl, WinReg.· DCERPC Alternate contexts, Multi-bind requests, Endianness selection· DCERPC NT and LM v1 authentication, integrity checking and encryption.· DCERPC v4 and v5 fragmentation, DCERPC v4 idempotent requests.The following tools are featured in Impacket:· RPCDump: An application that communicates with the Endpoint Mapper interface from the DCE/RPC suite. This can be used to list services that are remotely available through DCE/RPC, such as Windows Messenger. · SAMRDump: An application that communicates with the Security Account Manager Remote interface from the DCE/RPC suite. It lists system user accounts, available resource shares and other sensitive information exported through this service. · Tracer: An application (written using Tkinter) that displays a parallel coordinates graph of captured traffic. With this type of graph it is easy to detect unexpected network usage patterns. Tracer currently supports TCP and UDP traffic, but can be easily extended to handle other protocols. · Split: A tool that can divide any pcap supported capture file into several smaller files. This application was developed to manage megabytes of captured traffic. Split currently supports TCP streams, but can be easily extended to handle other stream-oriented protocols. · smbclient.py: A generic SMB client (writen using Impacket) that will let you list shares and files, rename, upload and download files and create and delete directories, all using either username and password or username and hashes combination. It's an excelent example to see how to use impacket.smb in action. · chain.py, oochain.py, loopchain.py and crapchain.py: Four different examples of how to chain SMB commands. The first one simply chains four commands. oochain will chain the same four commands, but send them out of order in the packet. loopchain will chain 2 commands in a loop, making the SMB server act like if receiving more than 200 commands. crapchain will chain the same four commands, but adding bogus data between them. · exploit.py and smb05-039-crash.py: exploit.py is the implementation of the class DCERPCExploit, which can be used as base to create DCERPC exploits. When doing an exploit based on this class, it will automatically have support to let the user tweak how the DCERPC traffic is sent. For example, you can configure the maximum fragment size, either for the transport (TCP/SMB/etc) or for DCERPC, it lets you select how you want the data to be read and writen, etc. ms05-039-crash.py is an example implementation of a crash (exploit only crashing the server) for the vulnerability described in Microsoft's advisory MS05-039.Requirements:· Python interpreter 2.0.1 and higherNOTE: Impacket is licensed and provided under a slightly modified version of the Apache Software License that you can view HERE.

Impacket Related Software