ADNET-008: WPAD Auto-Discovery Disabled
- Platform
- Active Directory
- Category
- AD Network & Relay Preconditions
- Severity
- Medium
- Zero Trust pillar
- Networks (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
ADNET-008 evaluates three independent controls and passes only when at least one of the high-impact controls is in place. The checks performed are: 1. DNS GlobalQueryBlockList. Reads HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\GlobalQueryBlockList on every DNS server that hosts the AD-integrated forward lookup zones. Confirms that the multi-string value contains "wpad" (and ideally "isatap"). Also confirms that EnableGlobalQueryBlockList is set to 1 (the default since Windows Server 2008). This is the single most impactful control because it stops every WPAD lookup forest-wide regardless of client configuration. 2. WinHttpAutoProxySvc service state. Reads HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Start on a representative sample of domain-joined endpoints. A value of 4 indicates the service is disabled outright, which is the strongest client-side control. Values of 2 (Automatic) or 3 (Manual) leave the client capable of resolving wpad if it ever requests proxy configuration. 3. Internet Explorer / Edge auto-proxy GPO settings. Reads the policy registry keys under HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings (and the legacy HKCU equivalents) for AutoDetect, AutoConfigURL, and the "Disable changing Automatic Configuration settings" policy. Confirms that auto-detection is disabled or that a fixed PAC URL is enforced and the user cannot change it. The check also enumerates the AD-integrated DNS zone for any pre-existing static "wpad" A or AAAA record. A static record pointing at a legitimate proxy is acceptable. A wildcard or a missing record combined with a missing GlobalQueryBlockList entry is the worst case because any client that asks for wpad will be answered by the first responder on the wire.
Why it matters
WPAD is the most reliable broadcast-listener credential-theft primitive on a Windows network and it predates LLMNR by a decade. Even environments that have correctly disabled LLMNR (ADNET-001) and NetBIOS over TCP/IP (ADNET-002) remain exposed if the WinHttpAutoProxySvc on a client can resolve "wpad" via plain DNS, because the service will then download an attacker-controlled PAC file and route every HTTP request through the attacker. PAC files are JavaScript and can selectively proxy only credentialed targets, which makes the attack low-noise. Once the attacker is the proxy they observe and modify HTTP traffic in cleartext, capture every NTLM authentication header the browser sends, and downgrade HTTPS via NTLM-authenticated CONNECT to capture Negotiate exchanges. The captured NTLM material is then relayed in real time to LDAP for object writes, to SMB for code execution on hosts where SMB signing is off (see ADNET-005), or to the ADCS Web Enrollment / NDES endpoint to mint a client-authentication certificate (PetitPotam-style, see ADNET-007). On dual-stack networks the same primitive is reached without any broadcast access at all: mitm6 advertises the attacker as the default IPv6 DNS server, the client then asks the attacker for wpad over IPv6, and the WPAD attack proceeds as if it were local. The blast radius is therefore every interactive user on every domain-joined Windows host that has not had WPAD shut off at both the DNS server and the endpoint.
Attack path
1. Position. The attacker either joins the broadcast segment (Responder on Linux, Inveigh on Windows), or obtains a foothold on any domain-joined host capable of running mitm6 against IPv6 (no privilege required, Windows has IPv6 enabled by default and prefers it). 2. Resolution capture. The attacker advertises themselves as the answer for "wpad" over LLMNR, NBT-NS, mDNS, or as the rogue IPv6 DNS server via DHCPv6 (mitm6 -d corp.contoso.com -i eth0). 3. PAC delivery. The victim WinHttpAutoProxySvc fetches http://wpad/wpad.dat. The attacker serves a PAC file (FindProxyForURL returns the attacker IP for the targets of interest and DIRECT for everything else, which keeps user-visible browsing functional and reduces detection). 4. Authentication capture. When the victim browser issues an HTTP request, Windows automatically sends NTLM credentials to the proxy because the proxy appears to be in the local intranet zone. Responder or ntlmrelayx captures NetNTLMv1 / v2 hashes. 5. Relay. ntlmrelayx -t ldaps://dc01 --delegate-access creates a computer account, configures RBCD onto a target host, and yields a SYSTEM shell. ntlmrelayx -t http://ca01/certsrv/certfnsh.asp -smb2support --adcs requests a client-auth cert as the victim, which is then converted to a TGT with certipy auth -pfx victim.pfx. ntlmrelayx -t smb://fileserver01 --no-smb-server runs commands directly when SMB signing is disabled on the target. 6. Persistence. The attacker can keep the WPAD listener running indefinitely, harvesting every newly logged-on user. PAC files can also be modified mid-session to selectively target high-value users only.
How Guerrilla assesses it
Guerrilla locates every DNS server in the forest by querying the nameserver records of every AD-integrated zone, then issues remote registry reads against HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters for GlobalQueryBlockList (REG_MULTI_SZ) and EnableGlobalQueryBlockList (REG_DWORD). The presence of "wpad" in the multi-string and a value of 1 for the enable flag is recorded as the authoritative DNS-side control. The check then enumerates each AD-integrated forward lookup zone via Get-DnsServerResourceRecord -RRType A and -RRType AAAA, looking for any explicit "wpad" record (a static record pointing at a real proxy is treated as an exception and passes). For client-side validation the check samples up to N domain-joined computers per OU (configurable, default 10), reads HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Start via Get-Service or remote registry, and reads the Internet Settings policy keys at HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. All raw values are emitted in the finding so an operator can see exactly which control is or is not in place and on which host or DNS server.
Recommended value
GPO disables WPAD via 'Turn off auto-proxy result caching' or by setting WinHttpAutoProxySvc start type to 4 (disabled), or DNS server has a wpad GlobalQueryBlockList entry
Remediation
Three complementary controls: (1) Add 'wpad' to the DNS server's GlobalQueryBlockList: dnscmd /Config /GlobalQueryBlockList wpad isatap; (2) Disable the WinHttpAutoProxySvc via GPO Services policy; (3) GPO Internet Explorer / Edge: 'Disable changing Automatic Configuration settings' and ensure no PAC URL is auto-configured. (1) is the single most impactful fix.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SC-8
- CIS AD Benchmark
- 6.3.4
- MITRE ATT&CK
- T1557.001, T1557.003