A novel attack chain that allows adversaries to hijack Windows Server Update Services (WSUS), the trusted patch-management architecture widely deployed across enterprise environments.
The research, published by SpecterOps researcher Beyviel David, demonstrates how organizations hosting WSUS on an external SQL Server database face a critical operational risk: attackers with local network access can coerce authentication, capture a database session, and mint malicious “updates” that domain-joined endpoints trust and execute automatically.
Windows Server Update Services Into Backdoors
Enterprise WSUS deployments frequently separate the update management server from its backend storage, hosting the SUSDB database on a standalone Microsoft SQL Server instance rather than using the default Windows Internal Database.
This architecture creates an exposure vector when combined with NTLM authentication coercion.
Using tools such as PetitPotam, an attacker can force the WSUS server’s computer account to authenticate over SMB to a host controlled by the adversary. The attacker then relays this authentication directly to the remote SQL Server database using Ntlmrelayx.
Because the WSUS computer account possesses permissions to establish a session on the SUSDB instance, this maneuver grants an authenticated database foothold without requiring valid domain user credentials.
Maintaining visibility over these relay vectors is critical for preserving Active Directory security across corporate networks.
WSUS machine account database mapping (Image source: Specterops)
Initial database access obtained via NTLM relaying places the attacker in the restricted webService role, which lacks direct SELECT, UPDATE, or DELETE permissions on core tables. However, researchers discovered that the permissions granted to execute specific stored procedures provide sufficient control to weaponize the update workflow.
By methodically chaining native SQL stored procedures—including spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, and spDeployUpdate an attacker can forge a complete Windows update package containing arbitrary metadata, file hashes, and execution instructions.
As detailed in the SpecterOps research report, this stored-procedure sequence allows an attacker to assemble valid update metadata directly inside the database.
Because the database interprets these commands as coming from the trusted WSUS computer account, the forged updates pass internal validation and are dispatched to targeted endpoint groups.
Securing update infrastructure is an essential component of overall Windows server security management.
Stored procedure EXECUTE permissions (Image source: Specterops.io)
Under normal operating conditions, WSUS requires that all delivered binaries carry a valid digital signature from a trusted Microsoft certificate, downloading payloads exclusively via the Background Intelligent Transfer Service (BITS) protocol.
SpecterOps researchers reverse-engineered the Microsoft.UpdateServices.ContentSyncAgent.dll library using dnSpy and identified a logic flaw inside the file-verification routine:
File Extension Check: The verification logic checks whether a payload filename ends in .txt or .esd.
Bypass Trigger: If either extension is detected, the routine skips digital signature validation entirely.
An attacker can rename an executable payload to a name such as Ghost.txt, host it on a BITS-compliant web server, and trigger WSUS to download and execute the unverified binary on target endpoints. This flaw facilitates unauthenticated code execution across client machines.
Attack PhaseMechanism / ComponentTechnical ImpactAuthentication CoercionPetitPotam + NtlmrelayxForces SMB auth to relay computer account session to SUSDBDatabase InjectionWSUS Stored Procedures (spImportUpdate, etc.)Forges malicious update packages within database tablesSignature BypassLogic flaw in ContentSyncAgent.dllSkips signature checks for .txt and .esd file extensionsPayload ExecutionBITS Protocol + Group PolicySilently installs payload with persistent auto-redeployment
Furthermore, if the target environment’s Group Policy is configured to automatically download and schedule update installations, the payload deploys without user interaction.
If the payload process is terminated, the malicious update automatically re-executes, establishing a persistent foothold on the victim host.
SpecterOps released two open-source projects to assist security teams:
ludus_wsus: An Ansible-based lab environment for deploying vulnerable WSUS instances for testing.
NotWSUSpicious: A Python utility that automates SQL stored-procedure chaining, bundled with a custom BITS server and a modified mssqlclient.py.
Enforce Extended Protection for Authentication (EPA): Enable EPA on the SQL database server hosting SUSDB to block NTLM relaying.
Network Segmentation: Restrict database network access so only authorized WSUS servers and administrative management hosts can connect.
Monitor Stored Procedure Invocations: Audit SQL execution logs for anomalous calls to spCreateTargetGroup, spDeployUpdate, or spSetBatchURL references involving .txt or .esd files.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Hackers Can Leverage WSUS Servers to Deliver Malware and Compromise Enterprise Endpoints appeared first on Cyber Security News.
