00:00:00.000-->00:00:06.792 >>Good morning, everyone. Uh. We’re here to talk about the Windows Update Architecture um 00:00:06.792-->00:00:11.417 more specifically WSUS. But before that, let me just introduce ourselves, uh, 00:00:11.417-->00:00:17.083 briefly. Here’s Yves. Uh. He works for the French National Security Agency. He works for- 00:00:17.083-->00:00:22.083 as a security auditor for more than ten years now. And I’m Romain. Uh. I’m, well, the 00:00:25.333-->00:00:30.333 security auditor, but I’m more a, uh, developer in the small company dealing with IT 00:00:32.583-->00:00:39.125 directory, uh, security issues. Before talking about the, uh, WSUS itself, I- I’ll introduce 00:00:39.125-->00:00:45.042 you to a problem- a scenario that we encountered sometimes, uh, during our pentests. So 00:00:45.042-->00:00:50.042 that’s you, waiting to compromise a network- the network. And somehow you get- 00:00:55.667-->00:01:01.625 you get a foothold inside it- this network. It can be by ph-phishing or, uh, or 00:01:01.625-->00:01:06.625 compromising a JBoss server, or Tomcat, uh, or iCloud with default credential. As anyone 00:01:08.708-->00:01:15.625 says- or, sorry, as anyone knows, when you, uh, compromise, uh, this, uh, kind of server, it 00:01:15.625-->00:01:20.625 runs with system privileges because you have to. It doesn’t work otherwise. So you pill 00:01:22.625-->00:01:28.833 through the credentials on this server. You manage to do some lateral movements. And at some 00:01:28.833-->00:01:33.833 point, you just realize that everything you have, uh, you’re blocked. You can’t go, uh, more 00:01:37.708-->00:01:42.708 in- in the network. But by looking at the, uh, information- the data that you, uh, get on 00:01:49.042-->00:01:55.750 these servers, you realize that there’s another network- a disconnected one next to the one 00:01:55.750-->00:02:00.750 you’re trying to compromise. The problem here is that you do not have any more credentials to get 00:02:02.875-->00:02:07.875 more into the network. So you’re basically screwed. But when you look at the servers you’ve 00:02:11.542-->00:02:18.125 compromised, there’s a WSUS server. And the question we are going, uh, to talk about in this 00:02:18.125-->00:02:23.125 talk is that what if you can use this WSUS server to compromise its clients and, more 00:02:27.083-->00:02:33.667 specifically, the domain controllers that our clients through the WSUS server. And to 00:02:33.667-->00:02:38.875 answer this question, we need to to understand a little bit of, uh, WSUS architecture. So here 00:02:38.875-->00:02:44.417 you are, the WSUS server inside the enterprise network which is synchronizing its updates with 00:02:44.417-->00:02:50.542 Microsoft updates servers. And this synch-synchronization is done in two steps. The first 00:02:50.542-->00:02:55.542 step is to synchronize the metadata on an https secret channel. And the second one is 00:02:57.583-->00:03:02.583 to, uh, synchronize the binaries associated with this metadata on an https- on an https, sorry, 00:03:06.125-->00:03:11.375 channel this time. This can be a problem, but actually isn’t because of the signature that 00:03:11.375-->00:03:17.708 any binary needs to have. We’re talking about authenticate signature here. So no one can 00:03:17.708-->00:03:22.708 actually temper with the binary even if the, uh, channel is not secret by TLS. The- in the 00:03:26.000-->00:03:31.000 metadata you have anything, uh, relating to the updates themselves. Uh, including the, 00:03:35.417-->00:03:40.958 uh, MS - uh, Microsoft bil- billington number, uh, the description of the updates, uh, 00:03:40.958-->00:03:47.667 whatever the information. And the binaries can be anything from a PSF file, a cabinet file, 00:03:47.667-->00:03:54.208 or a, more interesting for us, executable file. The executable file is a particularity, uh, 00:03:54.208-->00:03:59.917 because they- it can take common line arguments and the common line arguments are providing 00:03:59.917-->00:04:04.917 into the metadata which are unsigned. We’ll see, uh, why this is important later. Then 00:04:08.125-->00:04:14.542 inside the enterprise network, you have WSUS clients- can be Work Station, can be servers, 00:04:14.542-->00:04:20.500 uh, from a filer to a domain controller- that regularly synchronizes with- their updates 00:04:20.500-->00:04:25.500 with the WSUS server. They do it by default on an http channel. Microsoft is very- pushing 00:04:27.833-->00:04:34.833 forward to administrators to enable TLS, but it’s not really often the case. The updates are 00:04:34.833-->00:04:39.833 obviously applied with full system privileges because if you need to replace a critical, uh, 00:04:41.958-->00:04:48.250 part of the- of your system or you need to add full system privileges to do that. In more 00:04:48.250-->00:04:53.250 complicated network, you have what Microsoft calls an upstream and downstream servers. Think of 00:04:56.542-->00:05:01.542 a worldwide company with, uh, an internet like this and, uh, one policy to manage updates. You 00:05:04.542-->00:05:09.542 can chain servers and the updates will follow the- the chain. And if you have even more 00:05:12.375-->00:05:19.375 complicated networks, with disconnected ones for example, all- Microsoft is providing a 00:05:19.375-->00:05:24.375 tool to export updates from a WSUS server to an external, uh, disconnected WSUS server. So 00:05:28.375-->00:05:33.375 that’s a quick overview of the WSUS architecture. We’re going to talk about now the start of 00:05:35.833-->00:05:42.083 the art- state of the art of the attack on WSUS. And it’s going to be pretty quick because 00:05:42.083-->00:05:47.583 there’s only one attack that has been presented at Black Hat, USA two years ago now. It’s called 00:05:47.583-->00:05:53.083 WSUSpect and the idea of the attack is to get a manage-managemental position 00:05:53.083-->00:05:58.083 between the WSUS clients and a WSUS server to intercept the answer of the server, inject a 00:06:00.292-->00:06:06.458 fake update into the metadata stream because its on http channel inside the enterprise 00:06:06.458-->00:06:11.458 network and the metadata on site and the clients then apply this new update with system 00:06:14.292-->00:06:21.125 privileges. And that’s how you get, uh, control of the WSUS clients. This really is a non 00:06:21.125-->00:06:26.083 semantic because it’s the first on the Microsoft update architecture, but it has some 00:06:26.083-->00:06:30.917 limitation. The first one is that you need to get a managemental position. Meaning 00:06:30.917-->00:06:37.417 that there’s no network limitation in place such as private VLAN for example. And 00:06:37.417-->00:06:44.250 the second limitation is that you need to get a useful one. So here I presented you a not-not 00:06:44.250-->00:06:50.833 TLS enabled network. But sometimes administrators do their job and secure these, uh, 00:06:50.833-->00:06:57.542 strings. In our case it, uh, it’s difficult to put in place inside the network, uh- the 00:06:57.542-->00:07:02.542 internet connected network- but definitely, uh, can be, uh, used in- for the disconnected one. So 00:07:07.167-->00:07:12.167 we developed our own tool which is called WSUSpendu and it’s freely available on GitHub. The 00:07:14.500-->00:07:19.500 idea of the tool is not to have a network, uh, limitations, but if you have compromised a WSUS 00:07:22.583-->00:07:29.458 server, you can inject metadata into the database, and, uh, use a sign binary- we’ll talk about 00:07:29.458-->00:07:34.458 that later- uh, inside this WSUS server. And when the clients will download this update, it’ll 00:07:40.125-->00:07:45.125 see a new update and it will download this, uh, the binary, uh, related to this, uh, update. 00:07:48.875-->00:07:54.875 The first thing, uh, clients, uh, does when it downloads a binary is to check if the binary 00:07:54.875-->00:08:01.000 is signed by Microsoft. So you have to have a signed binary which can execute arbitrary 00:08:01.000-->00:08:06.000 commands. So the mo- the two most known binaries are, uh, PSExec and BGinfo. They are- 00:08:08.292-->00:08:15.000 they were presented, uh, with WS Expect Attack. But actually you can find other binaries if you 00:08:15.000-->00:08:21.417 look at the applocker Bypass Projects, such as the one we’ve sort of uh-subtyped. So you- you 00:08:21.417-->00:08:26.625 can use for example MS Bills or Install U2 which are two of the binaries which are signed by 00:08:26.625-->00:08:31.625 Microsoft. And that take common line arguments that can execute arbitrary commands. So you have 00:08:33.833-->00:08:42.292 in the metadata, common line arguments, the binaries signed. That’s how you get the control 00:08:42.292-->00:08:53.292 of the WSUS clients. >>Ok. So we have some video to demonstrate what could be done with 00:08:53.292-->00:09:04.667 WSUSpendu. Ok. In the scenario, we have compromised a bunch of servers but we don’t have 00:09:04.667-->00:09:15.125 compromised the domain controllers. So we can use some servers to try to compromise the 00:09:15.125-->00:09:18.792 domain controllers. And among the controlled servers- among the which we have compromised- 00:09:18.792-->00:09:24.875 there are WSUS servers. So we try to inject an update, a management update, to control 00:09:24.875-->00:09:33.333 all the clients. Here we are on a WSUS client. We have absolutely no privilege and no- 00:09:33.333-->00:09:42.292 no account on these, eh, servers. And right now only the administrator account is 00:09:42.292-->00:09:50.083 present. The aim of the attack is to add a new user on this, uh- on this, uh, computer. So as 00:09:50.083-->00:09:56.042 we have compromised the WSUS servers, we copy the binary, the resource [indiscernible], and 00:09:56.042-->00:10:00.000 the payload- PsExec in this case. And the servers and we want to launch- we want to 00:10:00.000-->00:10:07.875 launch an injection so we launch the injection of the payload, PSExec in this case, and some 00:10:07.875-->00:10:17.292 argument, to add a user. So we launch a command to add a specific user with a specific 00:10:17.292-->00:10:24.667 password. And while the update will be installed with system privileges, we take advantage of 00:10:24.667-->00:10:32.500 this to add the user in the local group, uh, administral group. Last thing we have to 00:10:32.500-->00:10:38.500 precise- we can precise is the computer name of the attacked computer. By processing it, we 00:10:38.500-->00:10:44.875 can automatically approve the update for this computer. We can check in the MMC console and 00:10:44.875-->00:10:51.625 after we phishing, we can see everything is ok, the update is present, and is approved for one 00:10:51.625-->00:10:58.667 computer among the four declare in the WSUS server. Ok we go- we go back to the client. And we 00:10:58.667-->00:11:06.250 have to have the client check so see if a new update is available. We can proceed by 00:11:06.250-->00:11:14.375 clicking on “check for updates.” And if, uh, an update is present, the system download it 00:11:14.375-->00:11:22.333 and starting with system privileges and the update will be installed. That’s it. So we 00:11:22.333-->00:11:28.500 can check now the user lists. And we can see the new user is present. And the user is a 00:11:28.500-->00:11:45.208 member of the administrators local groups so [applause] Mission succeeded. Ok. We have 00:11:45.208-->00:11:51.042 compromised the connected network. We have, uh, compromised all the connected 00:11:51.042-->00:12:01.542 network, but we want to have a more- intrusion in this, uh, the network. We have seen that a 00:12:01.542-->00:12:10.250 new- another network is, uh, present. But this network is not connected to the current network 00:12:10.250-->00:12:19.083 nor to the internet. So we want to inject an, um, an update in the WSUS server present in the 00:12:19.083-->00:12:27.083 connected network. And we want to wait that administrator, uh, transfer the update to keep to 00:12:27.083-->00:12:34.417 the to the update to, um, to disconnected network. So as we have compromised again the WSUS 00:12:34.417-->00:12:44.125 server in the connected network, we can launch the script, we can copy the WSUS responder prepared 00:12:44.125-->00:12:50.583 from an injection, and this time we want to launch PSexec but the argument of this PSexec is not 00:12:50.583-->00:12:56.417 to add a new user because it is not truly gone to a disconnected network but we want to launch a 00:12:56.417-->00:13:03.083 powershell and the argument of the powershell is an uncoded payload, we’ll see later what is 00:13:03.083-->00:13:09.000 this payload. This time we count precise the comp- the attacker computer because no, uh, 00:13:09.000-->00:13:15.750 computer of the disconnect-disconnected network is p- is, uh, known in this WSUS 00:13:15.750-->00:13:26.375 servers. Ok. The update is injected. We can see it in the MMC console again. And 00:13:26.375-->00:13:33.792 everything is ok. Now we have to wait that originality administrator as to perform its 00:13:33.792-->00:13:39.250 works to transfer the updates to keep up to date this disconnected network. So that’s 00:13:39.250-->00:13:46.375 the administrator is connected on the, uh, WSUS server, looking to the connected network It, um 00:13:46.375-->00:13:51.458 [clears throat] administrator transfer the update- the update binary and launch the WSUS tools 00:13:51.458-->00:13:57.417 provided b-by Microsoft to export the metadata from the database to an external device. 00:13:57.417-->00:14:07.208 After transferring the device and the disconnected network, we can import the updates. So with 00:14:07.208-->00:14:13.833 that, we copy the WSUS contact directory into the connected network, and launch again the 00:14:13.833-->00:14:22.542 WsusUtil to import metadata into the database. Now we can see the update in the WSUS servers 00:14:22.542-->00:14:26.958 located in the disconnected network. We can see some information like the 00:14:26.958-->00:14:34.792 classification, the secret- the, um, update as a security updates classification. We can see some 00:14:34.792-->00:14:40.292 of the information like the Microsoft bulletin and that’s 1710. The bulletin describes the 00:14:40.292-->00:14:53.500 IT exploit by WannaCry and the description is that all this information are, um, controlled 00:14:53.500-->00:15:03.708 by the metadata, sold by the WSUS, uh, WSUS responder. Now the preview of the WSUS servers 00:15:03.708-->00:15:10.208 depend on the configuration of the servers. If we check in the option, we can see that the 00:15:10.208-->00:15:17.542 default automatic approval rule is set. This option is active- is, uh, in a, uh, is present by 00:15:17.542-->00:15:21.833 default- but not active by default. In this case the administrator just enabled it. 00:15:21.833-->00:15:28.417 This would say that if we are in case of security updates classification that update would 00:15:28.417-->00:15:35.750 be automatically approved. So if, uh, it’s not, uh, it’s, uh, the case here so the update 00:15:35.750-->00:15:44.833 would be approved for all the computers. Now we go and, uh, Vteam. Vteam is-is a computer in 00:15:44.833-->00:15:51.583 the, um, disconnected network and we have to wait the Vteam search if a new update is 00:15:51.583-->00:15:58.375 available. We can test it again by click and “check for updates” and normally the update will be- 00:15:58.375-->00:16:06.667 uh, will arrived instead with system privileges. And if everything is ok, something will 00:16:06.667-->00:16:17.292 be open. Ok. Remember that the administrator just want just to update the-the disconnected 00:16:17.292-->00:16:24.750 network to protect again some ransomware as example. And after doing it, we see the effect is a 00:16:24.750-->00:16:49.042 little bit different. [applause] As an attacker we just have to wait for money now. Ok. So we 00:16:49.042-->00:16:54.000 have compromised the connected network. We have, uh, managed to transfer an update- a manager 00:16:54.000-->00:17:00.542 update to the disconnected network. And we have compromised the disconnected network. Ok. In 00:17:00.542-->00:17:10.792 conclusion, we can see that if we have, uh, WSUS servers in, uh- [laughter] If we have, uh, 00:17:10.792-->00:17:15.417 WSUS servers in, uh, the network, we have control relationship from the WSUS 00:17:15.417-->00:17:22.667 servers to all these clients. So we need to be careful about the positioning of this WSUS 00:17:22.667-->00:17:29.917 servers. When you design a new architecture, we, uh, we have to, uh, change with the WSUS 00:17:29.917-->00:00:00.000 servers. Thanks for your attention. [applause]