Description
This module runs a rogue DHCPv6 server that hands the attacker to IPv6 clients as their DNS server (the classic mitm6 primitive), and a paired DNS server that poisons names under a target domain to point at the attacker while transparently forwarding all other lookups so the victim stays functional.
Once a client resolves a target service through the attacker, it can be coerced into authenticating to the attacker. Paired with a Kerberos relay target (for example ESC8 AD CS web enrollment), this is the native coercion half of the Kerberos relay via DNS technique (CVE-2026-20929), removing the dependency on external tooling such as mitm6.
IPv6 is preferred by Windows over IPv4, so becoming the client's IPv6 DNS server is enough to intercept its name resolution even on IPv4 networks.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/spoof/dhcp/dhcpv6/dns_takeovermsf undefined(dns_takeover) > show actions ...actions...msf undefined(dns_takeover) > set ACTION < action-name >msf undefined(dns_takeover) > show options ...show and set options...msf undefined(dns_takeover) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub