Add native DHCPv6 DNS-takeover coercion (CVE-2026-20929) - #21724
Draft
Pushpenderrathore wants to merge 4 commits into
Draft
Add native DHCPv6 DNS-takeover coercion (CVE-2026-20929)#21724Pushpenderrathore wants to merge 4 commits into
Pushpenderrathore wants to merge 4 commits into
Conversation
Provide the native coercion half of the Kerberos relay via DNS (CVE-2026-20929), removing the dependency on external tooling like mitm6: - Add Rex::Proto::DHCPv6, a native DHCPv6 packet library (RFC 8415 plus the RFC 3646 DNS options): message/option encoding and helpers to build the rogue server responses that hand a client the attacker as its DNS server. - Add Rex::Proto::DHCPv6::Server, a reusable rogue DHCPv6 server that answers Solicit/Request/Renew/Rebind/Confirm/Information-Request. - Add auxiliary/spoof/dhcp/dhcpv6_dns_takeover, which runs the rogue DHCPv6 server and a paired DNS server that poisons names under a target domain (A/AAAA or a CNAME for the DNS-CNAME relay trick) while forwarding all other lookups so the victim stays functional.
Two defects found while validating the rogue DHCPv6 server against a live client on the lab network: - The multicast group join packed the interface index in network byte order, so on little-endian hosts the kernel joined on interface 0 and the server never received the multicast Solicit. Pack it in native byte order to match struct ipv6_mreq. - The client address was read assuming recvfrom always returns an address array, but older rex-socket versions return the host string directly, so the reply went to a malformed destination. Handle both shapes. With these fixes a cross-host Solicit is answered with an Advertise addressed correctly to the client on udp/546, handing out the attacker as the DNS server.
Move the selective DNS poisoning behaviour out of the DHCPv6 DNS takeover module into a reusable DNS::NamePoisoner mixin (TARGET_DOMAIN, TARGET_HOSTS, SPOOF_IP6, RELAY_CNAME plus the on_dispatch_request poison/forward logic and the IPv6 validation helper), so the upcoming Router Advertisement takeover module can share the exact same coercion behaviour instead of duplicating it. The DHCPv6 module now just includes the mixin and keeps its DHCPv6-specific options and server wiring. No behaviour change; its spec is unchanged and green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #21693.
Second of a stacked series adding native Kerberos authentication relay to Metasploit. #21709 contributes the relay stack and the ESC8 target. This PR contributes the DHCPv6 half of the coercion side, and the rogue Router Advertisement half follows in a separate PR stacked on this one.
Description
Metasploit has no native IPv6 DNS coercion primitive today, so the documented workflow for this class of attack depends on external tooling (mitm6). This adds it natively.
auxiliary/spoof/dhcp/dhcpv6_dns_takeoverruns a rogue DHCPv6 server that hands the attacker to IPv6 clients as their DNS server, paired with a DNS server that poisons names under a target domain and transparently forwards everything else so the victim stays functional. Windows prefers IPv6 over IPv4, so becoming the client's IPv6 DNS server is enough to intercept name resolution even on an IPv4 network.Once a client resolves a target service through the attacker it can be coerced into authenticating to the attacker. Paired with a Kerberos relay target such as ESC8 AD CS web enrollment, this is the coercion half of the Kerberos relay via DNS technique (CVE-2026-20929).
New supporting code:
Rex::Proto::DHCPv6(constants.rb,packet.rb,server.rb), a native DHCPv6 message parser and rogue server. Metasploit had no DHCPv6 support at all.Msf::Exploit::Remote::DNS::NamePoisoner, a shared mixin holding the poison-under-a-domain plus forward-everything-else DNS behaviour, so the Router Advertisement module in the follow-up PR reuses it rather than duplicating it.Related Issue: #21693
Breaking Changes
None. New module and new
Rex::Prototree, nothing existing is modified apart from themsf_autoload.rbinflection needed for theDHCPv6constant.Reviewer Notes
The
msf_autoload.rbchange is a Zeitwerk inflection sodhcpv6resolves toDHCPv6rather thanDhcpv6. Without it the constant does not load.Opened as a draft. Unit coverage is green and the DNS half has been exercised, but the full coerce to relay to certificate chain is not yet validated end to end. That validation needs a two host lab with the CA separate from the KDC, since a single host collapses the KDC into the relay target. Flagging that up front rather than after review.
The DNS poisoning is deliberately scoped to a configured domain with pass-through for everything else. A blanket poisoner breaks the victim immediately and gets noticed.
Verification Steps
bundle exec rspec spec/lib/rex/proto/dhcpv6 spec/modules/auxiliary/spoofand confirm no failures.use auxiliary/spoof/dhcp/dhcpv6_dns_takeover, setDOMAINto a domain you control in a lab,run. Confirm the DNS server reports it is poisoning names under that domain.Test Evidence
DNS half coming up against a lab domain:
Environment
Pre-Submission Checklist
documentation/modules(new modules only)lib/changes)