Microsoft Windows WPAD BadTunnel Exploit (MS16-077)

When a special NBNS request is received by this module, it starts to answer to the client by flooding responses with the name specified by the "NAME TO BE SPOOFED" parameter and the IP address specified by the "NAME's IP TO BE SPOOFED" parameter. When three NBNS request packets are received from the target, this module answers the request by sending responses to the target during 'n' seconds (parameter "Flooding time per target connection"). After that, if an HTTP request asking for "/lala2.bmp" is received, it means the target was convinced to use the spoofed name sent during the attack. When it happens, this module confirms that the attack was successful.
Exploit Platform
Exploit Type
Product Name