<aside> 📌 Summary

</aside>

LLMNR Poisoning

Definition

IPv6 DNS takeover is a cyber attack exploiting unused IPv6 protocol, where an attacker hijacks the Domain Name System (DNS) resolution process. By intercepting DNS requests or spoofing responses, the attacker misdirects traffic to malicious servers. Those attacks are more reliable than the previous ones since their less often taken into account.

Proof of Concept

DNS Takeover with MITM6

Now we need a tool to spoof an ipv6 DNS. In this way, we’ll use https://github.com/dirkjanm/mitm6 and ntlmrelayx. The first will spoof the DNS, while the second will dump data from the Domain Controller through LDAPS.

<aside> ⚠️ Do not let this run wildly during hours. This attack can cause a lot of trouble and even outages. Just let it run for a dozen minutes during interesting hours.

</aside>

First, let’s set up ntlmrelayx with the following parameters

• -6 to specify the usage of IPv6
• -t since we’re targeting ORB-DC LDAPS server
• -wh we need to give a fake wpad
• -l the name of the folder where everything will be lootted

ntlmrelayx.py -6 -t ldaps://<domain-controller> -wh wpadfake.orb.local -l lootme

Then we can start mitm6 simply with the -d parameter to specify a domain :

sudo mitm6 -d orb.local # root mandatory

<aside> 💡 If the event is an administrator login, the software will even create a user with the access required to dump even more data :) (an nothing else…)

</aside>

Then we need an event to occur. For this, it could simply be a booting-up computer, as shown below:

This gives us a lot of information. For instance, we can see the description for the SQL Service, which is the SQL Service password. We can also look for the domain administrator to define our targets.

<aside> 💡 Sometimes, passwords in descriptions are just honey pots to detect intrusions.

</aside>

Mitigation

1. Block DHCPv6 and Router Advertisements: In IPv4-only environments, prevent mitm6 attacks by blocking DHCPv6 traffic and incoming router advertisements in Windows Firewall using Group Policy. This ensures Windows does not query for an IPv6 address if not used internally, reducing the attack surface.
2. Caution with IPv6 Disabling: Disabling IPv6 entirely may cause unintended consequences. Instead, modify predefined rules in Windows Firewall to block specific inbound and outbound traffic for DHCPv6 and router advertisement.
3. Disable WPAD: If not in use internally, disable Web Proxy Auto-Discovery (WPAD) via Group Policy and disable the WinHttpAutoProxySvc service to prevent potential exploitation.
4. Enable LDAP Signing and Channel Binding: Mitigate LDAP and LDAPS relaying attacks by enabling both LDAP signing and LDAP channel binding for added security.
5. Protected Users Group: Consider adding administrative users to the Protected Users group or marking them as "Account is sensitive and cannot be delegated." This prevents user impersonation via delegation, enhancing security.