> For the complete documentation index, see [llms.txt](https://w4h33d.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://w4h33d.gitbook.io/hack-notes/active-directory-ad/active-directory-attacks/ipv6-attacks/ipv6-attack-in-action.md).

# IPv6 Attack In Action

## DNS Takeover

Now we learn about the IPv6 attack let's see it in action.

**Tools**

* `MITM6`
* `NTLMrelayx`

## Starting MITM6 server

```shell
$ mitm6 -d example-domain.loc
```

Where:

* `mitm6` is the tool name
* `-d` is used to specify the target domain name.

The above command will start the IPv6 Router and advertise itself on `example-domain.loc` and listen for connections and send him spoofed replies. Besides this, we must start the `ntlmrelayx` server simultaneously with `mitm6` using the following command.

**Other Syntax**

```shell
$ mitm6 -i eth0 -d example-domain.loc -hw ExampleHost
```

Where:

* `-i eth0`: is used to specify the network interface to listen in that case it's `eth0`.
* `-hw`: is used to specify white listed Host, This option is used to capture only requests for mentioned Host.

## Starting NTLMrelayx Server

```shell
$ ntlmrelayx.py -6 -t ldaps://192.168.100.1 -wh fakewpad.example-domain.loc -l loot
```

Where:

* `-6`: This flag indicates that the attack should be performed using IPv6.
* `-t ldaps://192.168.100.1`: This specifies the target server for the relay attack. In this case, the target server `192.168.100.1` is the domain controller IP address and the LDAPS protocol (LDAP over SSL/TLS) is used.
* `-wh fakewpad.example-domain.loc`: This specifies the fake WPAD (Web Proxy Auto-Discovery) server hostname.
* `-l loot`: This flag specifies the directory where the loot (collected data) from the attack will be stored. In this case, the `loot` directory is used.

**Other Syntax**

```shell
$ ntlmrelayx.py -t ldaps://192.168.100.1 --delegate-access --no-smb-server -wh fakewpad.example-domain.loc
```

Where:

* `--delegate-access`: This option enables the attacker to delegate the user's credentials to other services or servers if they are configured to accept delegation. Delegation allows the attacker to gain access to additional systems using the compromised user's credentials.
* `--no-smb-server`: This option disables the built-in SMB server functionality of `ntlmrelayx.py`. In other words, the tool will not create a fake SMB server to handle relayed SMB connections. This can be useful in certain scenarios where the attacker does not need SMB services but is primarily interested in other protocols such as LDAP.
* `-wh`: This option specifies the host to impersonate for the WPAD (Web Proxy Auto-Discovery) attack. In this case, the attacker is impersonating the host `fakewpad.example-domain.loc`, which is a fake WPAD server that can be used to trick clients into sending their proxy configuration requests to the attacker.

Both commands demonstrate different variations of using the `ntlmrelayx.py` tool for NTLM relay attacks, either with IPv6, specific options for LDAPS, WPAD impersonation, and storing loot or with delegation access and disabling SMB server functionality.

Starting both `mitm6` and `ntlmrelayx` servers simultaneously you are ready to intercept the request coming from the target system. Now it's just a matter of time before the target system gets the spoofed replies and becomes a victim of this attack.

The thing I should mention is that we can use the following protocols in the `-t` options in the `ntlmrelayx`. Choosing any of them solely depends on the system we are attacking and what kind of services they are running. Following are the commonly used protocol in NTLM relay attacks.

* `ldap://`: This protocol is used for unencrypted LDAP connections.
* `ldaps://`: This protocol is used for LDAP connections over SSL/TLS encryption.
* `http://` or `https://`: These protocols are used for HTTP or HTTPS connections.
* `rpc://`: This protocol is used for Remote Procedure Call (RPC) connections.

It's important to note that using encrypted protocols like LDAPS or HTTPS may require additional configuration and certificates for successful relay attacks. The `smb://` protocol cannot be used directly in the `ntlmrelayx.py` command for NTLM relay attacks. The `ntlmrelayx.py` tool is primarily designed for relaying authentication requests to other protocols such as LDAP, HTTP, or HTTPS.

However, it's worth noting that the SMB protocol itself can be exploited in various ways, including SMB Relay attacks, which are different from NTLM relay attacks as we already discussed previously. Although they use the `ntlmrelayx` tool they have different parameters.

**Read More**

1. <https://www.fox-it.com/en/news/blog/mitm6-compromising-ipv4-networks-via-ipv6/>
2. <https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/>
3. <https://chryzsh.github.io/relaying-delegation/>