Impacket mimikatz.py

Back to the category index / Back to the command index

Overview

Connects to a Mimikatz RPC server and sends commands entered interactively or read from a file.

Item	Details
Implementation	examples/mimikatz.py
Category	Remote execution / WMI / services
Size	238 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/mimikatz.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]
-file	File containing commands for the mini shell
-debug	Enable debug output
-ts	Add a timestamp to each log message
-hashes	NTLM hashes in LMHASH:NTHASH format
-no-pass	Do not prompt for a password (useful with -k)
-k	Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line
-aesKey	AES key for Kerberos authentication (128 or 256 bits)
-dc-ip	Domain controller IP address; if omitted, use the domain name (FQDN) from the target parameter
-target-ip	Target machine IP address; if omitted, use the target value. Useful when a NetBIOS target name cannot be resolved

Detailed processing flow

The tool creates an RPC transport from the target and credentials, then binds to the Mimikatz interface. MimikatzShell turns each line of input into a protocol request, decodes the response string, and displays it. With -file, it feeds lines through the same onecmd() path in a batch.

How it works

The command itself does not inject code into a remote process. Instead, it acts as a client of a Mimikatz RPC server already available on the target. It creates a DCE/RPC transport and string binding from the target, binds to the defined interface UUID, and places each input command in an NDR request structure.

MimikatzShell separates the local cmd.Cmd loop from remote RPC requests. It suppresses rerunning commands on empty lines. shell runs local OS commands, while onecmd() and default() send other input as remote Mimikatz commands. -file feeds each line through the same dispatch path, keeping interactive and batch protocol behavior consistent.

The client converts the server’s encoded response buffer to a string and displays it. A missing RPC server, an interface UUID mismatch, a server command error, and a character-encoding failure occur at different layers. Do not overinterpret new commands on the client; keep a clear boundary between bytes sent to the server and local shell commands.

Key implementation elements

Symbol	Location	Where to trace its responsibility
MimikatzShell	45	__init__(), emptyline(), precmd(), default(), onecmd(), do_exit(), do_shell(), do_help()
main()	114	Module function

Dependencies

Within Impacket

Module	Main names used
impacket	version
impacket.dcerpc.v5	epm, mimilib
impacket.dcerpc.v5.rpcrt	RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY
impacket.dcerpc.v5.transport	DCERPCTransportFactory
impacket.examples	logger
impacket.examples.utils	parse_target

External packages (used directly)

Import name	Distribution package	Import path and declaration status
Cryptodome	pycryptodomex	Imported directly; declared

Output, side effects, and required privileges

• Some operations change the target’s state. Check the target name, SID, and path before making changes.

Failure paths and cleanup

• On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.

When changing the implementation

The code depends on dcerpc.v5.transport, the Mimikatz RPC interface, and the shared target parser. Keep the local shell command distinct from remote commands and preserve RPC errors when the server is unavailable.

Verification

• Syntax: python -m py_compile examples/mimikatz.py
• CLI: python examples/mimikatz.py -h
• Related test: tests/SMB_RPC/test_rpcrt.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py