Skip to content

Part V Support Libraries

Chapter 7 A Quick Tour of the Common Libraries

These are impacket's foundational modules — a quick pass is enough.

ICMP6.py — IPv6 Ping

Implements ICMPv6 echo (ping) support for IPv6 hosts.

IP6_Address.py — IPv6 Address Parsing

IPv6 address parsing.

IP6.py — IPv6 Protocol

IPv6 protocol support.

IP6_Extension_Headers.py — IPv6 Extension Headers

IPv6 extension header support.

version.py — Version Information

Prints the current impacket version.

Dot11Crypto.py — 802.11 RC4 Encryption

RC4 encryption/decryption.

Dot11KeyManager.py — 802.11 Key Manager

802.11 (Wi-Fi) key manager support.

ImpactDecoder.py — Network Protocol Decoder

Convenient packet decoders for various network protocols.

ImpactPacket.py — Low-level Packet Codec

The basic building blocks of network packet codecs — low-level codecs for various Internet protocols, for building packets programmatically.

NDP.py — IPv6 Neighbor Discovery

Neighbor Discovery Protocol (NDP) support for IPv6.

cdp.py — Cisco Discovery Protocol

CDP support. CDP (Cisco Discovery Protocol) is a proprietary Layer-2 protocol by Cisco running on most Cisco gear; Cisco devices use it to share OS version, IP address, hardware platform and related information with directly connected devices.

crypto.py — Generic Algorithms incl. AES-CMAC (SMB3 signing)

Generic cryptographic check algorithms such as AES-CMAC (used for SMB3 signing etc.; distinct from krb5/crypto.py)

dhcp.py — DHCP Protocol

DHCP protocol support.

dns.py — DNS Protocol

DNS protocol support.

dot11.py — 802.11 Protocol

802.11 (Wi-Fi) protocol support.

dpapi.py — Windows Data Protection API (Chrome credential decryption)

DPAPI support — the Data Protection API. DPAPI is widely used across Windows applications and subsystems: file encryption, storage of wireless passwords, Windows Credential Manager, Internet Explorer, Outlook, Skype, Windows CardSpace, Windows Vault, Google Chrome and more. It is simple to use, exposing just a couple of functions to encrypt and decrypt data: CryptProtectData and CryptUnprotectData.

https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#13

  • On the victim host, decrypt Chrome credentials in the user's security context;
  • With the Chrome database pulled offline, decrypt Chrome credentials with mimikatz.

User master key files live in %APPDATA%\Microsoft\Protect\%SID%.

System master key files live in %WINDIR%\System32\Microsoft\Protect\S-1-5-18\User.

https://paper.seebug.org/1755/#2-windowsdpapi

eap.py — 802.1X Authentication

Wi-Fi 802.11 authentication protocol support.

ese.py — NTDS.dit Database Parsing

Parses NTDS.dit.

helper.py — Basic Packet Data Types

Basic packet data type definitions — bit, byte and friends.

hresult_errors.py — Windows Error Code Catalog

Windows error code catalog.

http.py — RPC over HTTP 401 Authentication

HTTP 401 authentication support for RPC over HTTP v2.

mapi_constants.py — Exchange MAPI Constants

Exchange error codes and MAPI properties.

mqtt.py — MQTT Protocol

MQTT protocol support.

nmb.py — NetBIOS Name Service

NetBIOS library.

smb3.py — SMB2/3 Protocol Implementation

MS-SMB2 protocol implementation (SMB2 and SMB3)

smb3structs.py — SMB2/3 Data Structures

SMB 2/3 protocol structures and constants [MS-SMB2].

smbconnection.py — SMB Connection Wrapper Class

Wrapper class over SMB1/2/3 — the SMB connection implementation.

smbserver.py — SMB Server

SMB server implementation.

system_errors.py — System Error Code Catalog

System error code catalog.

tds.py — SQL Server TDS Protocol

SQL Server (TDS) protocol support.

uuid.py — UUID ↔ Binary Conversion

Conversions between UUID and binary representations.

winregistry.py — Windows Registry Parser

Windows registry hive parser.

wps.py — WPS / WSC Wireless Configuration

WPS protocol support.

WPS (Wi-Fi Protected Setup) is the early name of the WSC (Wi-Fi Simple Configuration) specification, a technology that simplifies configuring and using wireless networks in SOHO environments. For example, setting up a wireless network normally requires the admin to configure the AP's SSID and security properties (authentication, encryption...) and then communicate the SSID and passphrase to every user — fiddly for ordinary people. With WSC, users just enter a PIN, press the Push Button, or tap an NFC phone against an NFC-capable AP, and the security settings are configured automatically — after which the phone can join the network. Clearly far simpler than memorizing SSIDs and passphrases. WPS appeared shortly after the Wi-Fi Alliance (WFA) introduced WPA, and with WPA2 the WFA produced its upgrade, WSC.