CVE-2016-3236

CRITICAL

Windows WPAD - Network Traffic Redirection via Proxy Discovery

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3236. PoCs published by vvalien, hdm, tombkeeper, including Metasploit module auxiliary/server/netbios_spoof_nat.

AI-analyzed exploit summary This Metasploit module exploits the 'BadTunnel' vulnerability (CVE-2016-3213, CVE-2016-3236) by spoofing NetBIOS responses to poison the target's cache, allowing NAT traversal. It brute-forces transaction IDs to ensure the spoofed response is accepted.

Description

The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows remote attackers to redirect network traffic via unspecified vectors, aka "Windows WPAD Proxy Discovery Elevation of Privilege Vulnerability."

Exploits (1)

metasploit WORKING POC

by vvalien, hdm, tombkeeper · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/server/netbios_spoof_nat.rb

View Code ZIP pw:eip

This Metasploit module exploits the 'BadTunnel' vulnerability (CVE-2016-3213, CVE-2016-3236) by spoofing NetBIOS responses to poison the target's cache, allowing NAT traversal. It brute-forces transaction IDs to ensure the spoofed response is accepted.

Classification

Working Poc 100%

Attack Type

Other

Complexity

Moderate

Reliability

Reliable

Target: Windows NetBIOS (pre-MS16-063/MS16-077 patches)

No auth needed

Prerequisites: Target must initiate a NetBIOS name request · Attacker must be on the same network or able to intercept traffic

MITRE ATT&CK

T1557 - Adversary-in-the-Middle T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-077

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036104

Scores

CVSS v3 9.8

EPSS 0.7766

EPSS Percentile 99.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-19

Status published

Products (10)

microsoft/windows_10

microsoft/windows_10 1511

microsoft/windows_7

microsoft/windows_8.1

microsoft/windows_rt_8.1

microsoft/windows_server_2008

microsoft/windows_server_2008 r2 sp1

microsoft/windows_server_2012

microsoft/windows_server_2012 r2

microsoft/windows_vista

Published Jun 16, 2016

Tracked Since Feb 18, 2026