WPAD spoofing
Last updated
Was this helpful?
Last updated
Was this helpful?
A proxy can be used to handle clients requests (for example to access the Internet). In a network in which the topology changes frequently, adaptive configurations are needed. A type of proxies called "Adaptive proxies" uses a configuration script.
The Web Proxy Automatic Discovery (WPAD) protocol helps clients in finding a proxy configuration script (wpad.dat). This script gives a set of proxies that can be used, and can be located with an hostname or an URL. Various mechanisms can be used to find its location (by order of resolution):
WinHTTP/WinINET
DHCP
DNS
Internet Explorer's LAN settings, or configuration file
WPAD spoofing can be combined with
combined (or not) with DNS spoofing
or , followed by
The -w/--wpad option will make Responder start the WPAD rogue server so that fake wpad.dat file can be served to requesting clients.
The -P/--ProxyAuth option to force the Windows client to authenticate after the wpad.dat is accessed and when the client starts using the proxy
On machines that are patched against that CVE, registering a name server (NS) record could still work.
On old Windows systems (i.e. lacking the MS16-077 security update), the WPAD location could be obtained through insecure name resolution protocols like LLMNR and NBT-NS when standard DNS queries were failing (i.e. no DNS record for WPAD). This allowed attackers to operate to answer those WPAD queries and redirect to a fake wpad.dat file, hence poisoning the web proxy configuration of the requesting clients, hence obtaining more traffic.
(Python) and (Powershell) are great tools for name poisoning. In addition to name poisoning, they also have the ability to start servers (listeners) that will and echo the NTLM hashes to the attacker.
The following command will start . Name resolution queries for the wpad server will be answered just like any other query. Fake authentication servers (HTTP/S, SMB, SQL, FTP, IMAP, POP3, DNS, LDAP, ...) will .
The following command will start . Name resolution queries for the wpad server will be answered just like any other query. Fake authentication servers (HTTP/S, SMB, SQL, FTP, IMAP, POP3, DNS, LDAP, ...) will (even from machine accounts) and set the Challenge to 1122334455667788 (to with ).
On up-to-date machines (i.e. with the MS16-077 security update applied), WPAD can still be abused through if the WPAD record does not exist. There is however a DNS block list mitigation called GQBL (Global Query Block List) preventing names like WPAD and ISATAP (default entries) to be resolved. This block list exists to reduce vulnerabilities associated with dynamic DNS updates but when .
On machines that are not patched against , there are two ways to bypass the GQBL: by or by registering a domain alias (DNAME) record, which can be conducted as follows with (Powershell).
In order for the NS record technique to work, the tester has to have a DNS server running for . This can easily be accomplished with (Python).
On up-to-date machines (i.e. with the MS16-077 security update applied), WPAD can still be abused through , even if the WPAD record does exist. With DNS poisoning through DHCPv6 spoofing, an attacker can reply to DHCPv6 requests, and then reply to DNS queries.
This attack can be conducted with (Python), see the page for exploitation notes.