Recent research has unveiled a sophisticated attack method that enables cybercriminals to exploit Windows Server Update Services (WSUS) to distribute malware across enterprise networks. WSUS is a critical component in many organizations, responsible for managing and deploying Microsoft software updates to connected systems.
In typical WSUS configurations, the update management server is separate from its backend storage, with the SUSDB database hosted on a standalone Microsoft SQL Server instance. This setup introduces a vulnerability when combined with NTLM authentication coercion techniques.
Attackers can leverage tools like PetitPotam to force the WSUS server’s computer account to authenticate over SMB to a server under their control. By relaying this authentication to the remote SQL Server database using tools such as Ntlmrelayx, the attacker gains authenticated access to the SUSDB without needing valid domain user credentials.
Once access is obtained, the attacker, operating under the restricted ‘webService’ role, can exploit permissions to execute specific stored procedures. By chaining procedures like spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, and spDeployUpdate, the attacker can craft a malicious Windows update package containing arbitrary metadata, file hashes, and execution instructions.
These forged updates, perceived as legitimate by the WSUS system, are then distributed to targeted endpoint groups. This method effectively turns the trusted update mechanism into a delivery channel for malware.
Furthermore, researchers identified a logic flaw in the ContentSyncAgent.dll library within WSUS. The file verification routine checks if a payload filename ends with .txt or .esd. If it does, the routine skips digital signature validation. Exploiting this, an attacker can rename a malicious executable to a .txt file, host it on a compliant web server, and prompt WSUS to download and execute the unverified binary on client machines.
To mitigate these risks, organizations should:
- Ensure WSUS servers are updated with the latest security patches.
- Implement strict network segmentation to limit access to WSUS servers.
- Monitor for unusual authentication requests and database activities.
- Review and adjust permissions associated with WSUS components to adhere to the principle of least privilege.
By proactively addressing these vulnerabilities, enterprises can safeguard their update infrastructure and prevent potential malware distribution through trusted channels.
