4 ms·

Another fun exercise is to announce IPv6 in a network that's designed to be IPv4 only (IPv6 is announced via its own protocol rather than via DHCP, though you c

Another fun exercise is to announce IPv6 in a network that's designed to be IPv4 only (IPv6 is announced via its own protocol rather than via DHCP, though you can also use DHCPv6 if you want to). High chances that the switches will not drop the announcement and that hosts will configure IPv6, then try to use it without the user knowing.

CaliforniaKarl 3y ago
Your post is incomplete. Instead of saying "announce IPv6", it might be better to say "announce IPv6 with SLAAC" or "announce SLAAC-supporting IPv6". If, in the Route Announcements, you enable the M flag, then that disables SLAAC on your subnet, forcing folks to use DHCPv6 for an IP allocation (or use a static IPv6 address). Besides, that "fun exercise" is what ISPs often do: For example, Comcast turned on IPv6 without any warning (at least, no warning pushed to customers). In my case, I (the user) didn't notice it was in use until I checked, which I think is exactly how it is supposed to work for the end-user.
kokx 3y ago
As a pentester that did exactly this in many corporate networks: this is extremely effective. Just announce with a router advertisement that there is a DHCPv6 server and start handing out link-local IPv6 addresses while you specify your own system as DNS-server. Clients (both Windows and Linux) will prefer the DNS-server specified through IPv6 over the one from IPv4. Then you can spoof any DNS record and capture juicy NTLM hashes flying through the network or relay their authentication and get a free authenticated connection. This is most effective in networks that were designed for only IPv4 and didn't consider IPv6 at all. But it is also effective in some networks that do use IPv6. Mitigations? Either disable the IPv6-stack on all systems, or configure your switches to block the router advertisements and do not allow DHCPv6 traffic to the wrong systems.

CaliforniaKarl 3y ago

Your post is incomplete. Instead of saying "announce IPv6", it might be better to say "announce IPv6 with SLAAC" or "announce SLAAC-supporting IPv6". If, in the Route Announcements, you enable the M flag, then that disables SLAAC on your subnet, forcing folks to use DHCPv6 for an IP allocation (or use a static IPv6 address). Besides, that "fun exercise" is what ISPs often do: For example, Comcast turned on IPv6 without any warning (at least, no warning pushed to customers). In my case, I (the user) didn't notice it was in use until I checked, which I think is exactly how it is supposed to work for the end-user.

kokx 3y ago

As a pentester that did exactly this in many corporate networks: this is extremely effective. Just announce with a router advertisement that there is a DHCPv6 server and start handing out link-local IPv6 addresses while you specify your own system as DNS-server. Clients (both Windows and Linux) will prefer the DNS-server specified through IPv6 over the one from IPv4. Then you can spoof any DNS record and capture juicy NTLM hashes flying through the network or relay their authentication and get a free authenticated connection. This is most effective in networks that were designed for only IPv4 and didn't consider IPv6 at all. But it is also effective in some networks that do use IPv6. Mitigations? Either disable the IPv6-stack on all systems, or configure your switches to block the router advertisements and do not allow DHCPv6 traffic to the wrong systems.