ADNET-007: Postura de mitigación de mitm6 en IPv6
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- High
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
mitm6 es el equivalente en IPv6 de Responder: un servidor DHCPv6 malicioso entrega un servidor DNS de enlace local y luego envenena las búsquedas de WPAD para recolectar credenciales. Las empresas que no han implementado IPv6 normalmente tampoco lo han deshabilitado, dejando IPv6 de enlace local habilitado sin ninguna postura defensiva. La mitigación consiste en implementar IPv6 correctamente con RA Guard / DHCPv6 Guard en el conmutador, o deshabilitar los componentes de IPv6 mediante DisabledComponents = 0xFF.
Por qué importa
IPv6 link-local addresses are autoconfigured on every Windows interface, and Windows prefers IPv6 over IPv4 for both DHCP solicit and DNS resolution. An attacker on the same broadcast domain who runs mitm6 will: - Respond to every DHCPv6 Solicit on the segment in under a millisecond, beating any legitimate IPv6 DHCP server (and there usually is none). - Assign a victim-side IPv6 address and set the attacker as the primary IPv6 DNS server. - Watch the victim subsequently resolve WPAD, internal hostnames, and SPN-bearing services through the attacker. - Pair with ntlmrelayx -6 -wh attacker-wpad to relay the resulting NTLM authentication to LDAP, LDAPS, SMB, MSSQL, or HTTP endpoints that lack EPA or signing. The classic chain ends at LDAP relay to a Domain Controller, where the attacker drops a delegation primitive (msDS-AllowedToActOnBehalfOfOtherIdentity) onto a workstation or registers a new computer object through MachineAccountQuota, then takes over the host via S4U2Self / S4U2Proxy. - Combine with ADCS Web Enrollment (ESC8) for relay to certificate issuance, producing a long-lived auth certificate for the victim user. Blast radius scales with the segment. On a flat office network, mitm6 will collect credentials from every workstation that reboots, locks, or refreshes WPAD until the attacker stops the tool. On a segment that includes a privileged workstation or a DA jump host, one cycle is enough for full domain compromise. The attack is silent to AD and to most EDR products because the malicious traffic is link-local IPv6 and does not touch any monitored Windows event channel.
Ruta de ataque
1. Foothold: the attacker has user-level access to a host on the corporate LAN, the guest VLAN with route to corporate, or a position to plug in a small Linux device (Raspberry Pi, dropbox, NUC). 2. Tool deployment: run mitm6 -i eth0 -d corp.contoso.com in one terminal, and impacket ntlmrelayx.py -6 -wh attacker-wpad.corp.contoso.com -t ldaps://dc01.corp.contoso.com --delegate-access --no-smb-server in another. 3. DHCPv6 race: mitm6 floods the segment with DHCPv6 Advertise replies, pointing every victim at the attacker as IPv6 DNS server. Every Windows host on the segment switches over within seconds to minutes (driven by DHCP renewal and reboot cadence). 4. Name resolution hijack: when the victim resolves WPAD, dc01, autodiscover, or any internal hostname, the attacker returns its own address. The victim opens an HTTP / SMB / LDAP connection and authenticates with NTLM. 5. Relay: ntlmrelayx forwards the authentication to ldaps://dc01. Because the user is authenticated to the DC, ntlmrelayx grants the attackers controlled computer account msDS-AllowedToActOnBehalfOfOtherIdentity over the victim machine. 6. Privilege escalation: the attacker uses Rubeus s4u or impacket getST.py to impersonate any user (including Domain Admins) onto the victim host, then dumps LSASS / SAM / DPAPI. 7. Persistence: the attacker can also relay to ADCS HTTP enrollment (ESC8), receive a client authentication certificate for the victim user, and PKINIT against the DC for a TGT that survives password rotation. 8. Cleanup: mitm6 leaves no AD artifacts. The only host-side indicator is a brief DHCPv6 lease event in the IPv6 client log.
Cómo lo evalúa Guerrilla
Guerrilla performs a two-pass detection. First pass enumerates every computer object via LDAP (objectClass=computer, operatingSystem like Windows), then for each reachable host queries HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents through StdRegProv WMI or remote registry. Hosts where the value is absent or not equal to 0xFF are flagged. Second pass walks every GPO in the domain via Get-GPO and inspects the Registry preferences XML (Preferences\Registry\Registry.xml) under both Computer Configuration and User Configuration for any entry targeting Tcpip6\Parameters\DisabledComponents. If no GPO sets the value and the host-level pass also reports gaps, the domain is reported as exposed. When the operator has supplied a credentialed scan profile, the check additionally samples ipconfig /all on a percentage of workstations and a percentage of servers to confirm that no DHCPv6 lease is present from a non-enterprise source. The output enumerates: host count missing the registry value, GPO count enforcing the value, sampled hosts with active DHCPv6 lease, and a recommendation specific to whether the domain is in the IPv6-unused or IPv6-deployed state.
Valor recomendado
IPv6 está deshabilitado en todo el dominio mediante DisabledComponents = 0xFF, O la red tiene RA Guard + DHCPv6 Guard implementados en la capa de acceso (fuera de banda, no detectable desde AD)
Remediación
Si no usa IPv6: inserte HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents = 0xFF (hex) mediante el Registro de GPO en todas las estaciones de trabajo y servidores. Si usa IPv6: asegúrese de que sus conmutadores de acceso apliquen DHCPv6 Guard / RA Guard para que los anuncios DHCPv6 no autorizados se descarten en el puerto. Microsoft ha declarado explícitamente que deshabilitar IPv6 por completo no es recomendable para Windows, pero es aceptable en entornos donde IPv6 no se utiliza.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-7, SC-8
- CIS AD Benchmark
- 6.3.3
- MITRE ATT&CK
- T1557.001, T1557.003