WSUS Spoofing
Last updated
Last updated
WSUS (Windows Server Update Services) allow administrators to centralize the management and deployment of Windows updates within their organization network. When first configuring this set of services, the default configuration makes the WSUS use HTTP without any secure layer like SSL/TLS. HTTPS is not enforced by default.
For example, a computer configured to get its updates from a WSUS server will initially perform the following handshake:
When pulling an update from the WSUS server, clients are redirected to the executable file to download and execute (which can only be a binary signed by Microsoft) and obtain a handler named CommandLineInstallation that specifies the additional parameters to pass the binary during the update installation. Without HTTPS, the WSUS is vulnerable to Man-in-the-Middle attacks where adversaries can either pose as the update server and send malicious updates or intercept and modify updates sent to the clients.
The evil WSUS server needs to be started before doing any ARP poisoning. The pywsus (Python) utility can be used for that matter.
Packets from the client to the WSUS server need to be hijacked and sent to the attacker's evil WSUS server. In order to do so, the attacker must pose as the client's gateway, route all traffic to the real gateway except the packets destined to the WSUS server.
The caplet above can be loaded with the following command in order to launch the ARP poisoning attack.
The search for Windows updates can be manually triggered when having access to the target computer by going to Settings > Update & Security > Windows Update > Check for updates.
All metadata exchanges between the client and the server is done using the Simple Object Access Protocol (SOAP). By exploiting the lack of integrity of the SOAP calls transmitted over an unencrypted HTTP channel, an attacker performing a MITM attack can tamper responses to the SOAP requests “” and “”.
Programs other than PsExec.exe can be used here. Using built-in programs features to bypass security restrictions or operate attacks like this is called Living off the land (LOL). Other Windows LOL binaries and scripts (a.k.a. LOLbins or LOLbas) can be found on .
Once the WSUS server is up and running, the ARP poisoning attack can start. The best tool to operate ARP poisoning is (Go) and for the majority of the scenarios, basic knowledge of the iptables utility is required.
By default, the automatic updates interval is 22 hours ().
urs ().
Another way of attacking insecure WSUS without having to rely on ARP poisoning but requiring user access to the target machine is explained in the following blogpost :
