Abusing WSUS

In most corporate environments, updates are distributed and installed centrally by administrators. For Windows-based infrastructure, the way to go is to install a WSUS server role on one of the servers in the network and force clients and servers to use it as a source of updates. WSUS can help to eliminate risks related to missing patches but can also be a target for compromise. The reason is simple: attackers can use it to distribute malicious code that will be automatically downloaded and installed and looks legitimate and trustworthy. Clients will get all the required information about the WSUS server by querying the registry key values in HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate. In essence, WSUS is a Simple Object Access Protocol (SOAP) XML web service. All updates must be signed by Microsoft, and WSUS checks the digital signature and hash of every update. However, Transport Layer Security (TLS) is not enabled by default, opening the first opportunity...