WSUSpendu: How to hang WSUS clients
Exploiting WSUS update infrastructure to control targeted systems from a compromised domain.
Summary
Post-Compromise Challenge
After owning a domain controller, compromising targeted systems should be straightforward. However, targets deeper in networks may be inaccessible through filtering.
WSUS Opportunity
Target domains pulling updates from WSUS servers controlled by the attacker create opportunity. Unfortunately, available tools don't work if network architecture prevents network attacks.
Novel Approach
A new approach circumvents limitations, allowing circumventing this problem. The attack exploits vulnerable architectures, allowing controlled update delivery.
Tools and Mitigations
Public tooling demonstrates the attack with in-context demonstrations. The presentation also explains vulnerable architectures and describes how to protect update infrastructure against similar attacks and air-gap scenarios.
Related talks
Main Stage·22 min
Justin Hendricks
Justin Hendricks details so You Think Your Domain Controller is Secure.
Main Track 1·47 min
Chris Thompson
Evaluates Windows Defender ATP and Microsoft Advanced Threat Analytics detection mechanisms and presents tradecraft for red teams to evade behavioral telemetry.
CSIT Village·13 min
Lim Jing Qiang
Lim Jing Qiang examines using the rubber ducky to deploy a large payload in an air-gapped environment is no easy feat.