Question

During an internal engagement, you notice the target Windows environment has IPv6 enabled on all workstations but no DHCPv6 server is deployed. You want to become the primary DNS server for these hosts to capture and relay authentication traffic to a domain controller. Which technique should you use to exploit this misconfiguration?

Accepted Answer

Use mitm6 to spoof DHCPv6 replies and advertise your host as the IPv6 DNS server, then relay captured credentials with ntlmrelayx

Answer

Launch an ARP cache poisoning attack with Ettercap to redirect IPv4 traffic through your host

Answer

Perform an SLAAC-only router advertisement flood to exhaust the IPv4 DHCP scope

Answer

Run Responder in analyze-only mode to passively fingerprint LLMNR broadcasts without responding