Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR: This is part 1 of a 2 part blog series sharing what I have discovered in my Windows Service Update Service (WSUS) research. If the WSUS database is configured on a separate server from the upstream WSUS server, we can coerce the WSUS computer account to the WSUS database and establish a SQL session. With this access, we can create custom malicious updates and specifically target computers with a handful of stored procedures.

Part 2 can be found here.

Introduction:

I was looking for something fun to research and WSUS crept into my mind. How cool would it be to take over a WSUS server and be in charge of all the updates pushed into the org? Then, last year, I remember being on an engagement where we had access to a WSUS database but couldn’t figure out exactly how to leverage it. That was enough for me to start deep diving it.

Acknowledgements

I just want to give credit to previous research and help that I had along the way!

Grant Hume from Sixgen for help bouncing ideas throughout the research

Phil Keeble from Netspi who wrote SharpWSUS (my discoveries were built on top of what Phil already discovered for lateral movement)

Romain Coltel from ALSID and Yves Le Provost from ANSSI whose 2017 BlackHat USA talk on WSUSpendu helped with understanding fragment types that part 2 of this series discusses

My colleague Garret Foster for his valuable guidance on Microsoft technologies and for his help on my PowerPoint slides

Erik Hunstad from BadSectorLabs for Ludus (where I did all my research and testing)

What is WSUS?

WSUS is the Windows Service Update Service. …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-1/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.