Check for vulnerable WPAD configuration?

[itm4n]

Check for vulnerable WPAD configuration?

[itm4n]

The original purpose of PrivescCheck was to find weaknesses that could lead to local privilege escalation. Over the time, I extended it a bit to report some configuration issues that could be leveraged for post-exploitation as well (such as dumping LSASS).

However, I don't want to transform it into an auditing tool. One could argue that you could use any poisoning attack (such as with WPAD) to coerce the machine account to authenticate to your machine and then relay it to LDAP for local privilege escalation, but that's a bit far-fetched as the actual vulnerability exploited in this scenario would be the lack of LDAP signing enforcement.

So, to answer your question. I don't think that adding such configuration check to PrivescCheck would make sense. FOr your information, when I assess the hardening level of a Windows machine, I use a script specifically made for that purpose (see https://github.com/scipag/HardeningKitty for instance).

[AdrianVollmer]

That makes sense. I can live with simply using HardeningKitty. I'll give it a shot, thanks for the hint!