impacket-rs is a ground-up Rust rewrite of the classic Impacket suite, offering 74 subcommands for authorized Active Directory auditing with dramatic speed and memory-safety gains.
| Tool | nestho/impacket-rs — pure-Rust, memory-safe redesign of core Impacket network protocols and Active Directory tooling |
| Category | Windows network protocol toolkit / Active Directory security tooling (Rust) |
| Primary Use | Authorized penetration tests, red team engagements and security audits covering remote execution, credential auditing, Kerberos analysis (GetNPUsers, GetUserSPNs, getTGT) and AD enumeration via SMB, LDAP, and Kerberos |
| Safe Use | For authorized security assessments, controlled lab environments, and defensive research on systems you own or have written permission to test; the Apache-2.0 codebase also supports protocol study and defensive detection engineering |
| Telemetry Note | Generates the same protocol footprints as Python Impacket — SMB dialect negotiation, MS-DRSR/DRSUAPI DCSync traffic, Kerberos AS-REQ/TGS-REQ patterns and MS-SCMR service creation — so existing detection rules for Impacket-style activity remain applicable; no interpreter process or python.exe parent chain is left behind, only the single static binary |
Few toolkits occupy as central a place in Windows security work as Impacket, and nestho/impacket-rs is an ambitious attempt to rebuild that entire ecosystem from scratch in pure Rust. According to the README, the project claims 100% upstream parity with 74 CLI subcommands spanning remote execution, credential extraction, Kerberos operations, relaying and network auditing, all shipped as a single self-contained multi-call binary. The rewrite targets security researchers, penetration testers, red teams and system administrators, and it is licensed under Apache-2.0 with around 40 stars at the time of this writing. The headline promises are memory safety, near-instant cold starts and order-of-magnitude throughput improvements over the Python original.
The performance story is the most concrete part of the README. Benchmarks run on Apple Silicon (M-series, 10-core) and Linux (AMD EPYC, 8-core) compare Python Impacket v0.12.0 against impacket-rs v0.1.0-dev in release builds. The numbers reported include CLI cold-start latency dropping from roughly 185.4 ms to 1.8 ms, NDR PDU pack/unpack throughput rising from about 42,000 to 5,850,000 operations per second, resident memory shrinking from 48.2 MB to 4.6 MB, and a 10,000-entry NTDS hash parse completing in 0.22 seconds instead of 14.8. Treat these as vendor-supplied figures rather than independently verified results, but the architectural rationale behind them — zero-allocation NDR marshaling and compile-time layout verification — is plausible for a systems language like Rust.
What stands out architecturally is the decision to implement the cryptographic primitives natively rather than link against C libraries. The README lists constant-time implementations of RC4, DES, 3DES, AES-128/256 in CBC, CTS, GCM and CCM modes, plus MD4, MD5, SHA-1, SHA-256, SHA-512, HMAC, PBKDF2, CMAC and Kerberos n-fold. For legacy Windows protocol work this matters: much of the DCERPC and Kerberos surface still relies on ancient primitives like MD4 and RC4, and having them in one auditable Rust codebase with zero runtime dependencies simplifies both deployment and review. It also means a single static binary for Linux via musl, which is a meaningful operational convenience for authorized engagements on restricted hosts.
The compatibility surface is deliberately broad on both ends. On the host side, the project provides pre-built binaries for Linux (x86_64 and aarch64, static musl), macOS (Apple Silicon and Intel) and Windows (MSVC builds), with a documented cross-compilation matrix using rustup target add. On the target side, the README claims coverage of Linux/UNIX ecosystems (Samba, FreeIPA, OpenLDAP, MIT/Heimdal Kerberos KDC) alongside Windows domains from Windows 2000 through Windows Server 2025, with automatic runtime dialect negotiation across modes the README names LegacyWin2000, UniversalAuto and ModernHardened. That cross-era framing suggests the authors put real effort into handling hardened modern SMB stacks as well as legacy environments common in long-lived enterprise networks.
The tool catalog is organized into functional families. Remote execution subcommands include the familiar psexec, smbexec, atexec, wmiexec, dcomexec and wmipersist, implemented over MS-SCMR, MS-TSCH, WMI Win32_Process and DCOM objects like MMC20. Credential tooling covers secretsdump (remote SAM/LSA via winreg and DCSync via MS-DRSR/DRSUAPI), secretsdump-local, ntdsdump for offline NTDS.dit parsing, an esentutl ESE database inspector, a dpapi masterkey decryptor, samedit for offline hive password modification and Get-GPPPassword for Group Policy cpassword decryption. All of these mirror the upstream Impacket taxonomy, which flattens the learning curve for anyone already fluent in the Python suite.
The Kerberos suite is particularly deep, and the README's interactive preview of getTGT shows support for FAST armoring per RFC 6113, encapsulating the AS-REQ inside PA-FX-FAST with PRF+ derived session subkeys and saving the resulting credential cache to a ccache file. Other Kerberos subcommands include GetNPUsers for AS-REP roasting against accounts with pre-auth disabled (also with FAST armor), GetUserSPNs for Kerberoasting-oriented SPN discovery with output in Hashcat/JtR formats, getST supporting S4U2self, S4U2proxy and U2U flows, and ticket forgery tooling under names like ticketer. The reported benchmark of roughly 98,400 Kerberos ticket encryptions per second, if accurate, makes large-scale ticket processing viable in ways the Python version could not support.
Active Directory enumeration and administration get their own family: ldapclient, GetADUsers, trueTree, dnstool, GetLAPSPassword and a findDelegation subcommand whose README preview renders delegation relationships as ASCII trust graphs — unconstrained delegation, constrained delegation with protocol transition, and resource-based constrained delegation are each visualized distinctly. This is a genuinely nice operator ergonomics touch, because delegation misconfiguration review is one of the most common tasks in an authorized AD assessment and the graph format makes tiering relationships immediately legible to a client during reporting.
Relaying capability is carried over through ntlmrelayx, and the README preview shows a multi-target routing table that can map incoming HTTP authentication toward SMB, LDAP, MSSQL or HTTP targets, with explicit flags for stripping the MIC (MsvAvFlags) and EPA channel bindings. There is also packet-level tooling such as a sniffer and lightweight network checks like rdp_check and mqtt_check. From a defensive standpoint, this parity means every detection signature your SOC has tuned for Impacket-style activity — MS-SCMR service creation, DCSync replication requests, unusual AS-REQ volumes — remains relevant against the Rust rewrite, since the wire behavior is intentionally identical.
Installation is straightforward in the Rust idiom: you can fetch pre-built static binaries from the GitHub Releases page, or build with cargo install --git https://github.com/nestho/impacket-rs impacket-rs if you have the Rust 1.75+ toolchain. The project ships a CI badge and a workspace test suite runnable with cargo test --workspace, and the README points to a docs/COMMAND_REFERENCE.md with detailed examples for all 74 subcommands — worth consulting before any engagement since the dev version number (v0.1.0-dev) suggests the API may still be settling.
One caveat worth stating plainly: this is a 0.1.0-dev project with a modest star count and extraordinary performance claims, so independent verification is warranted before relying on it for production assessments — benchmark it in a lab, review the cryptographic code, and compare output against trusted upstream Impacket for correctness. Within its stated scope, however, impacket-rs represents a technically serious modernization effort: it takes the most-used Windows protocol toolkit in the offensive field and re-expresses it in a language whose guarantees align unusually well with the fragility of the legacy wire formats it manipulates. For authorized professionals working Windows environments from Windows 2000 relics to Server 2025 domains, it is a project worth tracking closely.
nestho/impacket-rs.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.