> For the complete documentation index, see [llms.txt](https://coffeetohack.gitbook.io/coffeetohack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://coffeetohack.gitbook.io/coffeetohack/active-directory/ipv6-attacks.md).

# IPv6 Attacks

Firstly I setup MITM6 in Kali machine: mitm6 -d marvel.local

<div align="left"><figure><img src="/files/UM7OqRkCMb9MzGJydzCa" alt=""><figcaption></figcaption></figure></div>

Once MITM6 was setup, I setup NTLMRelayx: `ntlmrelayx.py -6 -t ldaps://192.168.64.151 -wh wpad.marvel.local -l lootme`

In the above command, -6 refers to IPv6, the IP address is of DC, -wh value is gained from the output of mitm6, -l creates a lootme directory with various loots.

Once the two commands were running, I restarted the Frank Castle machine and logged in as the Frank Castle user. Upon doing this, it dumped the loot in the lootme directory.

<div align="left"><figure><img src="/files/R1wbvOi2J2S8ZojKuMOa" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/OdY6RgglWRyAM0YGPyLa" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/oWu26ZYFTdUfWOojKCl4" alt=""><figcaption></figcaption></figure></div>

Then I logged in with MARVEL\Administrator user in the Frank Castle machine. This time, ntlmrelay created a new user for me.

<div align="left"><figure><img src="/files/wuSRkDUbASf34MIyjfUu" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="/files/8z8fzWlopjof70GyRzI7" alt=""><figcaption></figcaption></figure></div>

The user gets created. It is a Domain User with special ACL permissions assigned to it.

There are several other attacks that can be performed:

<https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/>