WSuspicious

WSuspicious

Summary

This is a proof of concept program to escalate privileges on a Windows host by abusing WSUS. Details in this blog post: https://www.gosecure.net/blog/2020/09/08/wsus-attacks-part-2-cve-2020-1013-a-windows-10-local-privilege-escalation-1-day/ It was inspired from the WSuspect proxy project: https://github.com/ctxis/wsuspect-proxy

Acknowledgements

Privilege escalation module written by Maxime Nadeau from GoSecure

Huge thanks to:

• Julien Pineault from GoSecure and Mathieu Novis from ‎SecureOps for reviving the WSUS proxy attack
• Romain Carnus from GoSecure for coming up with the HTTPS interception idea
• Paul Stone and Alex Chapman from Context Information Security for writing and researching the original proxy PoC

Usage

The tool was tested on Windows 10 machines (10.0.17763 and 10.0.18363) in different domain environments.

…

Examples

Compilation

The ILMerge dependency can be used to compile the application into a standalone .exe file. To compile and compile the application, simply use the following command:

dotnet msbuild /t:Restore /t:Clean /t:Build /p:Configuration=Release /p:DebugSymbols=false /p:DebugType=None /t:ILMerge /p:TrimUnusedDependencies=true