+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: An explanation of the windows 7 IPv6 RA Denial of Service Attack (/showthread.php?tid=2606210)
An explanation of the windows 7 IPv6 RA Denial of Service Attack - Friedrich Schiller - Jun 21, 2012
There is a rather popular post here about a layer 7 denial of service method which directly exploits ipv6 on windows 7 machines.
Original Thread: https://hackforums.net/showthread.php?tid=2602208
I recently tested it at home using backtrack and it is everything it lives up to be. There is no doubt of the absolutely amazing raw destructive power inherent in this DoS method.
Here is a video explaining how it works from defcon 19, I HIGHLY recommend you watch this all the way through it is very informative.
Backtrack 5 has this program automatically built in and is very easily accessed from the terminal. The command is:
Code
flood_router6 interfacewhere interface is wlan0 or eth0 or ath0
It seems only cisco has decided to act on this vulnerability by adding RA guards to their switches (don't worry, you can bypass that). The only other clear way of stopping the attack is by turning networking discovery off so that computers do not try to automatically connect to each of the randomly spammed ipv6 prefixes flooding the network. Word has it that microsoft also refuses to patch this problem until the later editions of Windows 8, possibly into Windows 9!
This is a very very dangerous tool, use it with care. I'm actually tempted to try and down an entire internet cafe or library later next week, if I decide to I will post a thread on the forums telling tales of my plunder!
🤝
Also if anybody can find this style of DoS working over internet (non local) networks PLEASE post some information, I have seen some floating around the net but nothing too informative yet.
* - Ironside - Jun 21, 2012
Too bad it only works within LAN though.
* - EmperorDAZ - Jun 21, 2012
You can actually load this motherfucker in a mobile phone and wreck computers in that network (as long it's vulnerable, obviously). Simply use an android, install a debian on it, install the required libraries and the thc-ipv6 suite then you're good to go.
This tool actually works because windows and some other vulnerable systems update their routing tables and it seems they tend to consume loads of CPU resource
during the process If I am correct.
* - Friedrich Schiller - Jun 21, 2012
O.o Wow I know what I'm doing when I have spare time
* - fred goffa - Jun 22, 2012
Thank you for posting this i love to see good matrial posted on hack furoms
Very nice posted i really enjoyed what u posted up
but its not hard to configur a denial of service attack like this on a external level, i know how to , most attacks through lan can be used on a external level its all how u do it
* - FastFive - Jun 22, 2012
yo man post a vid if you take out a wireless starbucks or something... that would be cool
* - Maxitj - Jun 23, 2012
(Jun 22, 2012 03:38 PM)FastFive Wrote: yo man post a vid if you take out a wireless starbucks or something... that would be cool
Would be hard to shoot 👹 ...
* - Friedrich Schiller - Jun 23, 2012
^ Yes it would be, unless I bring a super sneaky hidden camera.
* - sethyy - Jun 23, 2012
I'd really appreciate a video of this or something...
* - TickTack - Jun 23, 2012
If you have the balls you should try it on a hospital network. Specifically one where the staff and the visitors use the same public network.
* - thesnipair.24 - Jun 23, 2012
I think it might work not local only if you open the ports for the network discovery or SMB .. try it .
* - Friedrich Schiller - Jun 23, 2012
@Tick Tack
Yeah man I so 1337 b4d4zz fo sho' I will nuk3 dem s1ck p33p0l yo.
* - nerdtopia - Aug 20, 2014
do all networks already have an ipv6 address ? If not how would this work