Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1

What it is

Part 1 of a reverse-engineering series on ZDI-26-708, an authentication-coercion primitive in Windows NCSI (Network Connectivity Status Indicator). It carries the concrete internals the summary abstracts away: the specific WinHTTP option NCSI gets wrong, the probe-mode branch that applies the user's proxy, and a five-step PoC. The bug is unpatched; Microsoft classified it Moderate–Spoofing and declined a CVE, so it will not be prioritized for a fix.

How it works

Two independent details the summary omits:

• The WinHTTP option mistake. While preparing the active-probe session, NCSI calls WinHttpSetOption with WINHTTP_OPTION_DISABLE_PROXY_AUTH_SCHEMES but passes 0x100 (WINHTTP_PROXY_DISABLE_AUTH_LOCAL_SERVICE). The bit that actually disables NTLM is 0x04, which NCSI never sets — so NTLM is not disabled on the captured path. (The author notes WinHTTP was not shown ignoring a policy; NCSI simply failed to set the right bit.)
• The user-proxy probe branch. NCSI's reversed probe modes include types 4 and 5, the "user-proxy" modes. In that branch, NcsiHttpGet opens a no-proxy session, then explicitly applies the stored proxy via WINHTTP_OPTION_PROXY (38), after setting the undocumented WINHTTP_OPTION_PROXY_DISABLE_SERVICE_CALLS (137). The proxy string is already resident (IsUserProxyConfigured = 1, set when WinINet emits Event ID 5600; a WNF callback then queues the probe). No user impersonation occurs — the request runs as NETWORK SERVICE with user-chosen destination.

Preconditions / Affected

• Windows 11 / Server 2022+ run NCSI under Network List Service (netprofm, svchost.exe -k netprofm); Windows 10 uses NLA. Both host ncsi.dll as NETWORK SERVICE.
• A relay chain additionally needs the host domain-joined, plus a relay target lacking signing/channel-binding. The non-domain-joined test showed no computer account in the auth exchange.

What to do

Reproduce with the author's minimal PoC:

1. Log on as a non-administrative user.
2. Configure a manual proxy or PAC URL you control.
3. Let the proxy change trigger NCSI's active probe.
4. Return 407 Proxy Authentication Required.
5. Observe the request and NTLM exchange originating from the netprofm process.

Inspect current proxy state (also reveals PerUserProxySettings):

netsh winhttp show advproxy

Confirm origin via Process Monitor (TCP connection from the netprofm svchost) or WinDbg at the point NCSI handles user-proxy metadata.

Caveats

The author is explicit that this is a coercion primitive, not a complete escalation chain: usefulness depends on domain membership, the auth WinHTTP negotiates, and an unprotected relay target. Part 2 (unwritten here) traces the root cause to Event ID 5600 and includes the author's failed attempts.