ADNET-007: IPv6 mitm6 Mitigation Posture
- Platform
- Active Directory
- Category
- AD Network & Relay Preconditions
- Severity
- High
- Zero Trust pillar
- Networks (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla evaluates the IPv6 posture across two layers because the attack is a Layer 2 / Layer 3 abuse that AD itself cannot see. Registry layer (per-host, queryable from AD): - HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents (REG_DWORD). The check reads this on every domain-joined Windows machine reachable via remote registry or via a GPO Registry preference inventory. The supported safe value is 0xFF (255 decimal), which disables all IPv6 tunnel and native interfaces and forces preference for IPv4. A value of 0x00 (or missing) indicates the Microsoft default: IPv6 enabled with preference over IPv4. - HKLM\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters\Interfaces\{GUID}\Dhcpv6State to detect whether DHCPv6 client is actively soliciting. GPO layer: - Searches every linked GPO for a Registry preference that sets DisabledComponents or for the equivalent Administrative Template setting in newer ADMX bundles. A finding fires when no GPO at any scope sets the value and the local hosts also lack it. Network posture indicators (best-effort, since AD cannot read switch config): - The check flags the domain as exposed when DHCPv6 server addresses are observed in ipconfig /all output on sampled clients, since legitimate enterprise DHCPv6 would normally be inventoried. It also reports any host where the IPv6 default route or DNS server is not from the enterprise allocation.
Why it matters
IPv6 link-local addresses are autoconfigured on every Windows interface, and Windows prefers IPv6 over IPv4 for both DHCP solicit and DNS resolution. An attacker on the same broadcast domain who runs mitm6 will: - Respond to every DHCPv6 Solicit on the segment in under a millisecond, beating any legitimate IPv6 DHCP server (and there usually is none). - Assign a victim-side IPv6 address and set the attacker as the primary IPv6 DNS server. - Watch the victim subsequently resolve WPAD, internal hostnames, and SPN-bearing services through the attacker. - Pair with ntlmrelayx -6 -wh attacker-wpad to relay the resulting NTLM authentication to LDAP, LDAPS, SMB, MSSQL, or HTTP endpoints that lack EPA or signing. The classic chain ends at LDAP relay to a Domain Controller, where the attacker drops a delegation primitive (msDS-AllowedToActOnBehalfOfOtherIdentity) onto a workstation or registers a new computer object through MachineAccountQuota, then takes over the host via S4U2Self / S4U2Proxy. - Combine with ADCS Web Enrollment (ESC8) for relay to certificate issuance, producing a long-lived auth certificate for the victim user. Blast radius scales with the segment. On a flat office network, mitm6 will collect credentials from every workstation that reboots, locks, or refreshes WPAD until the attacker stops the tool. On a segment that includes a privileged workstation or a DA jump host, one cycle is enough for full domain compromise. The attack is silent to AD and to most EDR products because the malicious traffic is link-local IPv6 and does not touch any monitored Windows event channel.
Attack path
1. Foothold: the attacker has user-level access to a host on the corporate LAN, the guest VLAN with route to corporate, or a position to plug in a small Linux device (Raspberry Pi, dropbox, NUC). 2. Tool deployment: run mitm6 -i eth0 -d corp.contoso.com in one terminal, and impacket ntlmrelayx.py -6 -wh attacker-wpad.corp.contoso.com -t ldaps://dc01.corp.contoso.com --delegate-access --no-smb-server in another. 3. DHCPv6 race: mitm6 floods the segment with DHCPv6 Advertise replies, pointing every victim at the attacker as IPv6 DNS server. Every Windows host on the segment switches over within seconds to minutes (driven by DHCP renewal and reboot cadence). 4. Name resolution hijack: when the victim resolves WPAD, dc01, autodiscover, or any internal hostname, the attacker returns its own address. The victim opens an HTTP / SMB / LDAP connection and authenticates with NTLM. 5. Relay: ntlmrelayx forwards the authentication to ldaps://dc01. Because the user is authenticated to the DC, ntlmrelayx grants the attackers controlled computer account msDS-AllowedToActOnBehalfOfOtherIdentity over the victim machine. 6. Privilege escalation: the attacker uses Rubeus s4u or impacket getST.py to impersonate any user (including Domain Admins) onto the victim host, then dumps LSASS / SAM / DPAPI. 7. Persistence: the attacker can also relay to ADCS HTTP enrollment (ESC8), receive a client authentication certificate for the victim user, and PKINIT against the DC for a TGT that survives password rotation. 8. Cleanup: mitm6 leaves no AD artifacts. The only host-side indicator is a brief DHCPv6 lease event in the IPv6 client log.
How Guerrilla assesses it
Guerrilla performs a two-pass detection. First pass enumerates every computer object via LDAP (objectClass=computer, operatingSystem like Windows), then for each reachable host queries HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents through StdRegProv WMI or remote registry. Hosts where the value is absent or not equal to 0xFF are flagged. Second pass walks every GPO in the domain via Get-GPO and inspects the Registry preferences XML (Preferences\Registry\Registry.xml) under both Computer Configuration and User Configuration for any entry targeting Tcpip6\Parameters\DisabledComponents. If no GPO sets the value and the host-level pass also reports gaps, the domain is reported as exposed. When the operator has supplied a credentialed scan profile, the check additionally samples ipconfig /all on a percentage of workstations and a percentage of servers to confirm that no DHCPv6 lease is present from a non-enterprise source. The output enumerates: host count missing the registry value, GPO count enforcing the value, sampled hosts with active DHCPv6 lease, and a recommendation specific to whether the domain is in the IPv6-unused or IPv6-deployed state.
Recommended value
Either IPv6 is disabled domain-wide via DisabledComponents = 0xFF, OR the network has RA Guard + DHCPv6 Guard deployed at the access layer (out-of-band, not detectable from AD)
Remediation
If you don't use IPv6: push HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents = 0xFF (hex) via GPO Registry to all workstations and servers. If you do use IPv6: ensure your access switches enforce DHCPv6 Guard / RA Guard so rogue DHCPv6 advertisements are dropped at the port. Microsoft has explicitly stated that disabling IPv6 entirely is not recommended for Windows but is acceptable for environments where IPv6 is unused.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SC-7, SC-8
- CIS AD Benchmark
- 6.3.3
- MITRE ATT&CK
- T1557.001, T1557.003