mitm6

Hijacks DNS over IPv6 to become MITM and chain an NTLM relay.

It abuses the fact that Windows prefers IPv6 even on an IPv4 network: mitm6 answers DHCPv6 requests and advertises itself as the machines' IPv6 DNS server, positioning itself as man-in-the-middle. Combined with ntlmrelayx it redirects the hosts' authentication (WPAD) and relays it to LDAP/ADCS. A classic credential-less domain-takeover vector.

Family NTLM coercion & relay

Flags -d <domain> -i <iface>

Concepts NTLM Relay, NTLMv2 coercion with SCF/URL (IconFile UNC)

Cheatsheet LLMNR / NBT-NS poisoning

Installation

pipx install mitm6

Repositorygithub.com/dirkjanm/mitm6

Useful commands3 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.