IPv6 Router Advertisement DNS Takeover (RDNSS IPv6 DNS coercion)

Description

This module runs a rogue IPv6 router that advertises the attacker as the recursive DNS server (RDNSS, RFC 8106) inside Router Advertisements, and a paired DNS server that poisons names under a target domain to point at the attacker while transparently forwarding all other lookups so the victim stays functional.

It is the Router Advertisement equivalent of the mitm6 DHCPv6 DNS takeover: instead of answering DHCPv6 Solicits, it multicasts RAs carrying an RDNSS option, which modern Windows (and other RFC 8106 clients) adopt as their IPv6 resolver. It also listens for Router Solicitations and replies with a unicast RA immediately, so a client is coerced the moment it boots or refreshes rather than waiting for the next unsolicited advertisement. By default the RA does not claim to be a default router (router lifetime 0), so routing is left untouched and only DNS is taken over.

Once a client resolves a target service through the attacker, it can be coerced into authenticating to the attacker. Paired with a Kerberos relay target (for example ESC8 AD CS web enrollment), this is a native coercion half of the Kerberos relay via DNS technique (CVE-2026-20929), removing the dependency on external tooling such as mitm6.

IPv6 is preferred by Windows over IPv4, so becoming the client's IPv6 DNS server is enough to intercept its name resolution even on IPv4 networks. Layer 2 adjacency (same segment) and root privileges to inject raw packets are required.