Microsoft Windows Unprivileged DNS Cache Flushing

A non-administrative user can flush the DNS cache, effectively neutralizing the TTL’s impact on incoming responses. Although the ‘ipconfig’ command (when run together with the ‘/flushdns’ switch) does verify that the user has administrative rights (the verification is done by calling advpapi32.dll!CheckTokenMembership with BUILTIN\Administrators), this restriction can be bypassed either by calling DnsApi.dll!DnsFlushResolverCache or by directly issuing the appropriate RPC to the stub resolver service.