WSUS
Windows Server Update Services
HTTP MitM
Check:
PS > reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate /v WUServer
WUServer REG_SZ http://wsus.megacorp.local:8530
PS > reg query HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU /v UseWUServer
UseWUServer REG_DWORD 0x1Exploit:
Local Proxy (LPE)
WSUS + LDAPS NTLM Relay
Tools
SharpWSUS
Last updated