ADNET-008: Detección automática de WPAD deshabilitada
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- Medium
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Web Proxy Auto-Discovery resuelve el nombre 'wpad' mediante DNS, NetBIOS o LLMNR y confía en cualquier configuración de proxy que reciba. Un atacante puede envenenar cualquiera de esas resoluciones y actuar como proxy del tráfico web de la víctima. Incluso con LLMNR y NetBIOS deshabilitados, el servicio WinHttpAutoProxySvc todavía puede intentar WPAD, por lo que se recomienda una GPO de defensa en profundidad que deshabilite WPAD por completo.
Por qué importa
WPAD is the most reliable broadcast-listener credential-theft primitive on a Windows network and it predates LLMNR by a decade. Even environments that have correctly disabled LLMNR (ADNET-001) and NetBIOS over TCP/IP (ADNET-002) remain exposed if the WinHttpAutoProxySvc on a client can resolve "wpad" via plain DNS, because the service will then download an attacker-controlled PAC file and route every HTTP request through the attacker. PAC files are JavaScript and can selectively proxy only credentialed targets, which makes the attack low-noise. Once the attacker is the proxy they observe and modify HTTP traffic in cleartext, capture every NTLM authentication header the browser sends, and downgrade HTTPS via NTLM-authenticated CONNECT to capture Negotiate exchanges. The captured NTLM material is then relayed in real time to LDAP for object writes, to SMB for code execution on hosts where SMB signing is off (see ADNET-005), or to the ADCS Web Enrollment / NDES endpoint to mint a client-authentication certificate (PetitPotam-style, see ADNET-007). On dual-stack networks the same primitive is reached without any broadcast access at all: mitm6 advertises the attacker as the default IPv6 DNS server, the client then asks the attacker for wpad over IPv6, and the WPAD attack proceeds as if it were local. The blast radius is therefore every interactive user on every domain-joined Windows host that has not had WPAD shut off at both the DNS server and the endpoint.
Ruta de ataque
1. Position. The attacker either joins the broadcast segment (Responder on Linux, Inveigh on Windows), or obtains a foothold on any domain-joined host capable of running mitm6 against IPv6 (no privilege required, Windows has IPv6 enabled by default and prefers it). 2. Resolution capture. The attacker advertises themselves as the answer for "wpad" over LLMNR, NBT-NS, mDNS, or as the rogue IPv6 DNS server via DHCPv6 (mitm6 -d corp.contoso.com -i eth0). 3. PAC delivery. The victim WinHttpAutoProxySvc fetches http://wpad/wpad.dat. The attacker serves a PAC file (FindProxyForURL returns the attacker IP for the targets of interest and DIRECT for everything else, which keeps user-visible browsing functional and reduces detection). 4. Authentication capture. When the victim browser issues an HTTP request, Windows automatically sends NTLM credentials to the proxy because the proxy appears to be in the local intranet zone. Responder or ntlmrelayx captures NetNTLMv1 / v2 hashes. 5. Relay. ntlmrelayx -t ldaps://dc01 --delegate-access creates a computer account, configures RBCD onto a target host, and yields a SYSTEM shell. ntlmrelayx -t http://ca01/certsrv/certfnsh.asp -smb2support --adcs requests a client-auth cert as the victim, which is then converted to a TGT with certipy auth -pfx victim.pfx. ntlmrelayx -t smb://fileserver01 --no-smb-server runs commands directly when SMB signing is disabled on the target. 6. Persistence. The attacker can keep the WPAD listener running indefinitely, harvesting every newly logged-on user. PAC files can also be modified mid-session to selectively target high-value users only.
Cómo lo evalúa Guerrilla
Guerrilla locates every DNS server in the forest by querying the nameserver records of every AD-integrated zone, then issues remote registry reads against HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters for GlobalQueryBlockList (REG_MULTI_SZ) and EnableGlobalQueryBlockList (REG_DWORD). The presence of "wpad" in the multi-string and a value of 1 for the enable flag is recorded as the authoritative DNS-side control. The check then enumerates each AD-integrated forward lookup zone via Get-DnsServerResourceRecord -RRType A and -RRType AAAA, looking for any explicit "wpad" record (a static record pointing at a real proxy is treated as an exception and passes). For client-side validation the check samples up to N domain-joined computers per OU (configurable, default 10), reads HKLM\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc\Start via Get-Service or remote registry, and reads the Internet Settings policy keys at HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. All raw values are emitted in the finding so an operator can see exactly which control is or is not in place and on which host or DNS server.
Valor recomendado
Una GPO deshabilita WPAD mediante 'Desactivar el almacenamiento en caché de resultados de proxy automático' o estableciendo el tipo de inicio de WinHttpAutoProxySvc en 4 (deshabilitado), o el servidor DNS tiene una entrada wpad en GlobalQueryBlockList
Remediación
Tres controles complementarios: (1) Agregue 'wpad' a la GlobalQueryBlockList del servidor DNS: dnscmd /Config /GlobalQueryBlockList wpad isatap; (2) Deshabilite el servicio WinHttpAutoProxySvc mediante la directiva de Servicios de GPO; (3) GPO de Internet Explorer / Edge: 'Deshabilitar el cambio de la configuración automática' y asegúrese de que no haya ninguna URL de PAC configurada automáticamente. (1) es la corrección de mayor impacto.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8
- CIS AD Benchmark
- 6.3.4
- MITRE ATT&CK
- T1557.001, T1557.003