{"id":13840602,"url":"https://github.com/GoSecure/WSuspicious","last_synced_at":"2025-07-11T09:32:27.163Z","repository":{"id":41559433,"uuid":"254473340","full_name":"GoSecure/WSuspicious","owner":"GoSecure","description":"WSuspicious - A tool to abuse insecure WSUS connections for privilege escalations","archived":false,"fork":false,"pushed_at":"2020-10-30T17:52:36.000Z","size":181,"stargazers_count":346,"open_issues_count":4,"forks_count":49,"subscribers_count":24,"default_branch":"master","last_synced_at":"2024-11-12T15:43:28.629Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GoSecure.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-09T20:36:53.000Z","updated_at":"2024-10-27T20:21:40.000Z","dependencies_parsed_at":"2022-07-09T00:16:09.537Z","dependency_job_id":null,"html_url":"https://github.com/GoSecure/WSuspicious","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FWSuspicious","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FWSuspicious/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FWSuspicious/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2FWSuspicious/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GoSecure","download_url":"https://codeload.github.com/GoSecure/WSuspicious/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225712535,"owners_count":17512420,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:00:50.835Z","updated_at":"2024-11-21T10:30:28.437Z","avatar_url":"https://github.com/GoSecure.png","language":"C#","readme":"# WSuspicious\n\n## Summary\nThis is a proof of concept program to escalate privileges on a Windows host by abusing WSUS.\nDetails in this blog post: https://www.gosecure.net/blog/2020/09/08/wsus-attacks-part-2-cve-2020-1013-a-windows-10-local-privilege-escalation-1-day/\nIt was inspired from the WSuspect proxy project: https://github.com/ctxis/wsuspect-proxy\n\n## Acknowledgements\nPrivilege escalation module written by Maxime Nadeau from GoSecure\n\nHuge thanks to:\n* Julien Pineault from GoSecure and Mathieu Novis from ‎SecureOps for reviving the WSUS proxy attack\n* Romain Carnus from GoSecure for coming up with the HTTPS interception idea\n* Paul Stone and Alex Chapman from Context Information Security for writing and researching the original proxy PoC\n\n## Usage\nThe tool was tested on Windows 10 machines (10.0.17763 and 10.0.18363) in different domain environments.\n\n```\nUsage: WSuspicious [OPTION]...\nEx. WSuspicious.exe /command:\"\" - accepteula - s - d cmd / c \"\"\"\"echo 1 \u003e C:\\\\wsuspicious.txt\"\"\"\"\"\" /autoinstall\n\nCreates a local proxy to intercept WSUS requests and try to escalate privileges.\nIf launched without any arguments, the script will simply create the file C:\\\\wsuspicious.was.here\n\n/exe                The full path to the executable to run\n\t\t\t\t    Known payloads are bginfo and PsExec. (Default: .\\PsExec64.exe)\n/command            The command to execute (Default: -accepteula -s -d cmd /c \"\"echo 1 \u003e C:\\\\wsuspicious.was.here\"\")\n/proxyport          The port on which the proxy is started. (Default: 13337)\n/downloadport       The port on which the web server hosting the payload is started. (Sometimes useful for older Windows versions)\n\t\t\t\t    If not specified, the server will try to intercept the request to the legitimate server instead.\n/debug              Increase the verbosity of the tool\n/autoinstall        Start Windows updates automatically after the proxy is started.\n/enabletls          Enable HTTPS interception. WARNING. NOT OPSEC SAFE. \n\t\t\t\t    This will prompt the user to add the certificate to the trusted root.\n/help               Display this help and exit\n```\n\n### Examples\n![WSuspicious Privesc Example gif](https://github.com/GoSecure/WSuspicious/raw/master/docs/privesc.gif)\n\n## Compilation\nThe ILMerge dependency can be used to compile the application into a standalone .exe file.\nTo compile and compile the application, simply use the following command:\n```\ndotnet msbuild /t:Restore /t:Clean /t:Build /p:Configuration=Release /p:DebugSymbols=false /p:DebugType=None /t:ILMerge /p:TrimUnusedDependencies=true\n","funding_links":[],"categories":["C# (212)","C# #"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGoSecure%2FWSuspicious","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FGoSecure%2FWSuspicious","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGoSecure%2FWSuspicious/lists"}