Can an unprivileged user on a Windows machine spoof DNS responses the machine it is running on makes? For example, if a privileged command prompt ran nslookup example.com, can an unprivileged process intercept the request or affect the reply?

  • To do what you ask, a Windows process would need to control the networking stack. That requires admin privileges. – schroeder Apr 19 at 6:41
  • Unless there's a specific exploit that can cause it, no. – Overmind Apr 19 at 7:04
  • Right, I was thinking on the lines of GetUdpTable. GetUdpTable returns all active connections, so if you spammed in a significant amount and the second the udp connection is made you should be able to see the dns packet and then respond quickly? – Bill Richard Apr 19 at 7:09
  • It sounds possible to use that technique to see when a DNS request is made, but you're not going to be able to produce a valid reply without seeing the contents of the packet, for which you would need a packet sniffer installed. – multithr3at3d Apr 20 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.