39:51This recording is not available yet.
Categories
Security Operations & Incident ResponseDetection & HuntingNetwork Security & Zero TrustOffensive Security & ExposurePentesting & Red Teaming
Vendors and tools discussed
About this session
Three GoSecure penetration testers, Romain Carnus, Maxime Nadeau and Mathieu Novis, revisit the WSUS client-side attack first shown by Paul Stone and Alex Chapman in 2015 and explain why it still matters. Windows Server Update Services deployed over plain HTTP lets a machine-in-the-middle attacker tamper with the unsigned metadata of update requests: although update binaries must carry a valid Microsoft signature, the URL and command-line arguments are not protected, so a signed tool such as PsExec or BGInfo can be pointed at a rogue server and made to run arbitrary code as SYSTEM. They describe porting the old proof of concept to current Windows using ARP spoofing, and releasing their own standalone rogue server, PyWSUS, which separates interception from update delivery. They then report a local privilege escalation: because the update client trusted the per-user proxy setting, an unprivileged user could redirect traffic to PyWSUS and run code as an elevated account. Their tool WSUSpicious demonstrated it, earned a Microsoft bounty and was patched. The defensive half covers detection (Windows Filtering Platform port events, proxy-key changes, the signed binary spawned by the update process) and mitigation: enforce HTTPS for remote code execution and apply the patch for the privilege escalation.
In 2015, Paul Stone and Alex Chapman presented a novel attack at the BlackHat USA conference. Their talk covered their exploration of the usual enterprise deployment of the Windows Update infrastructure (WSUS) and culminated into the release of WSUSpect-proxy, a tool that allows attackers to inject malicious updates and compromise hosts during a Machine-in-the-Middle (MITM) attack.
Five years later, this tool has been poorly maintained and, even with this threat uncovered, we still see unencrypted WSUS servers in almost all our intrusion testing engagements. This highlights the fact that the threat is largely underestimated. First, its implementation encourages an HTTP-based deployment which is vulnerable by design. Furthermore, even organizations willing to harden WSUS will struggle to achieve a secure deployment since its technical resources and online documentation are lacking. In an effort to nail the coffin once and for all on HTTP-based WSUS, we wanted to dig deeper into the issue and performed CPR on the WSUSpect-proxy tool.
This presentation will cover our research into WSUS, our new twist on the WSUS attack vector, and our revival of the WSUSpect-proxy threat model. Our research resulted in the birth of four different tools covering three different attack scenarios. Scenarios include previously undocumented techniques, while others describe bounty-awarded yet-to-be-disclosed Microsoft 0-days. This talk will bring value to both intrusion testers and defenders by covering both sides of these scenarios, from exploitation to detection and mitigation.
Key takeaways
- Enforce HTTPS on every WSUS deployment: the Microsoft signature on update binaries does not protect the unsigned metadata, so HTTP allows remote code execution as SYSTEM.
- Apply the Microsoft patch for the WSUS local privilege escalation and stop unprivileged users from changing proxy settings; HTTPS alone does not close this path.
- Find vulnerable clients by reading the WUServer and WUStatusServer registry keys or the relevant Group Policy objects, or by inspecting traffic in Wireshark on the WSUS ports.
- Detect exploitation by watching for the Windows update process spawning a signed tool like PsExec, a user proxy-key change, and a local port opening, correlated together.
- Watch for machine-in-the-middle signals (gratuitous ARP, rogue DHCP, unexpected hosts on a switch port) since the rogue server means the real WSUS server never receives the client's connection.
Speakers
Maxime Nadeau
Maxime is currently the Director of Ethical Hacking at GoSecure. Jack of all trades, master of some, he does have a pronounced interest in adversary simulation and physical security. Originally a software engineer, he is now conducting intrusion… Read moreRead less
Maxime is currently the Director of Ethical Hacking at GoSecure. Jack of all trades, master of some, he does have a pronounced interest in adversary simulation and physical security. Originally a software engineer, he is now conducting intrusion tests and built service offerings that include physical security intrusion and testing. He is a returning presenter at the GoSec conference, cybersecurity competition winner and NorthSec challenge designer.
