Taking Over WSUS and SCCM

In this final chapter of the book, we will focus on attacking infrastructure management solutions. These are valuable and attractive targets for an adversary as such systems are operated under highly privileged accounts with access to almost every piece of the target environment. Windows Server Update Services (WSUS) is a service to deploy updates to the client computers in a centralized manner. Microsoft Endpoint Configuration Management (MECM) – formerly known as System Center Configuration Manager (SCCM) – is an on-premises management solution for endpoints. This product helps IT professionals run system inventory, patching, software deployment, and so on.

We will start by discussing known attacks on WSUS and then show how it can be abused for lateral movement. However, the main focus of this chapter is on SCCM. After the introduction and necessary theory, we will move on to the deployment stage. When our lab is ready, it is time to go...