The popular Impacket toolkit , a staple in penetration testing and now integrated into the Kali Linux repository , is set to receive a major upgrade.
See also: Kali Linux now runs in Apple containers on macOS
The upcoming release, maintained by Fortra and based on version 0.12, addresses long-standing community requests with improved relay capabilities, protocol enhancements, and new scripting tools.
This update promises to optimize Red Team's operations in modern Windows environments, making it easier to navigate complex Active Directory configurations and relay attacks.
At the core of the release are powerful additions to ntlmrelayx.py, transforming it into a flexible relay handler. Security researchers can now directly serve SCCM Management Points and Distribution Points, allowing rogue clients to be registered to extract secret policies or sniff packets for sensitive data.
A new RPC listener and EPM bootstrapper simplify the spins from printer errors to ADCS exploitation, condensing multi-step attacks into single commands.
Further innovations include a WinRM relay target that forwards incoming NTLM authentications from sources such as SMBv1, LDAP, HTTP , or recorded hashes to create interactive shells over local TCP ports.
See also: Kali Linux 2025.2 brings 13 new tools and updates
The SOCKS proxy plugin extends support for LDAP and LDAPS traffic, allowing seamless integration with existing tools without custom rewrites. Logging improvements link attacks to specific relayed connections, providing detailed information about victims who have been forced to commit.
To address evolving defense mechanisms, Impacket enhances connection and channel signing across LDAP, Kerberos , and SQL. SASL improvements ensure compatibility with domains that enforce unsigned connections, while a revamped TDS handshake in mssqlclient.py handles encryption and CBT natively, eliminating external dependencies like PyOpenSSL.
MSSQL workflows see practical upgrades: enriched version banners for scripting, fixed uploads on non-English systems, and new CLI command feed for mssqlclient.py. SMB refactoring resolves sharing violations for real-time file copies, including event logs, and improves signing to mimic native Windows behavior.
See also: Kali Linux: Update failures after losing repo signing key
The release introduces new examples such as badsuccessor.py for manipulating dMSA based on Akamai research, enabling the inventory and exploitation of vulnerable organizational units (OUs).
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
