Weaponizing Windows Updates with NotWSUSpicious

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR: NotWSUSpicious is a tool repo to aid in creating custom updates after gaining access to a WSUS database server. The Turning Enterprise Update Servers Into Backdoor Factories (0_o) series covers how the database takeover works. This blog strictly covers how to use the tooling.

The series can be found here:

Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1

Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2

Of Course We Built a WSUS Ludus Lab

Introduction

This blog walks through step by step how to perform the WSUS takeover that I discovered in my WSUS research. I wrote this tool because manually creating the SQL queries was a massive headache and led to errors in my testing.

Requirements

Python3 3.11

The WSUS server must be configured to use an external MSSQL server

Extended Protection for authentication (EPA) must not be required on the MSSQL server

Establishing the SQL Session

In part 1 of the series, I covered how if a WSUS server is configured to use an external MSSQL database server, we could coerce authentication from the WSUS server to our attack machine and relay the NTLM authentication to the the database server and establish a SQL session as the WSUS computer account.

The first step is to setup Ntlmrelayx to relay authentication to the target database server. Make sure to change the IP address of the target to the IP address of the external SQL server.

(env) root@host:~# ntlmrelayx.py -t mssql://10.2.10.2 -socks -smb2support Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies

[*] …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.