Question

During an internal engagement, you notice Windows clients attempting to resolve the hostname 'wpad' via broadcast because DNS lookups fail. You want to intercept their proxy configuration requests to force NTLM authentication that you can then relay to a target server with SMB signing disabled. Which technique most directly enables this attack chain?

Accepted Answer

Poison the WPAD hostname resolution to serve a malicious proxy auto-config file that prompts clients for authentication, capturing NTLM credentials for relay

Answer

Perform a Kerberoasting attack against the proxy service account to extract an offline-crackable TGS ticket

Answer

Launch a DHCP starvation attack to exhaust the address pool and force clients onto a rogue gateway

Answer

Send crafted ICMP redirect packets to reroute client HTTP traffic through your attacker host