Turning Enterprise Update Servers Into Backdoor Factories (0...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-1
• Blog Title: Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1
• Suggested Section: Windows Hardening → Lateral Movement → WSUS Update Server Abuse, with cross-references to NTLM relay and 1433 - Pentesting MSSQL

🎯 Content Summary

Core finding and severity. This Part 1 article describes a high-impact WSUS control-plane abuse chain rather than a named CVE. When the WSUS database is hosted on a separate standalone Microsoft SQL Server, an attacker can coerce the upstream WSUS computer account to authenticate over SMB to an attacker-controlled listener, relay that NTLM authentication to the external MSSQL server, and obtain a SQL session as the WSUS machine account, shown in the lab as LUDUS\WSUS1$...

🔧 Technical Details

External WSUS-database NTLM relay: If WSUS stores its database on a separate MSSQL server, coerce the upstream WSUS computer account to authenticate over SMB to an attacker-controlled listener, capture the NTLM exchange with ntlmrelayx, and relay it to MSSQL. If the SQL server accepts the relayed machine-account authentication, the attacker obtains a database session without knowing the computer-account password. Relaying to another WSUS server only provides administrative lateral movement when the upstream account has sufficient rights there; relaying to the external database can still be useful when downstream WSUS administration is unavailable.

Stored-procedure-only update injection: Direct table permissions are not required when an application role has EXECUTE access to state-changing stored procedures. Enumerate procedure definitions through sys.procedures and OBJECT_DEFINITION, then call the WSUS procedure...

🤖 Agent Actions

Plan:

1. Map the relevant Windows lateral-movement, WSUS, NTLM-relay, and MSSQL pages.
2. Read at least five candidate files and check for existing coverage.
3. Verify the primary technical sources and decide whether to amend an existing page or create one.
4. Implement one non-duplicative, cited update.
5. Validate links, Markdown structure, references, and the final diff.
   Repository mapping is complete. I found no dedicated WSUS page, so I’m now comparing the lateral-movement index and adjacent NTLM/MSSQL abuse pages to avoid duplicating existing techniques and to match their organization and citation style.
   The comparison confirms that the existing WSUS material covers client HTTP relay, not compromise of a remote SUSDB. The closest precedent is the SCCM machine-account-to-MSSQL page, but this WSUS chain has a distinct stored-procedure write primitive and selective update-deployment workflow, so a dedicated lateral-movement page is warranted.
   I’m implementing a single technical page under Windows lateral movement. It will keep the relay setup as a prerequisite and focus on the new material: effective SUSDB procedure permissions, the parent/child metadata state machine, digest-to-URL binding, and selective deployment. The index and book summary will receive navigation links only.
   The page and navigation links are in place. I’m now validating the exact diff, internal relative paths, citation numbering, forbidden-source absence, Markdown constraints, and mdBook compatibility; I’ll correct any issues found before finishing.
   Validation found no broken internal paths, whitespace errors, forbidden-source references, or citation-number mismatches. All five external references resolve successfully. mdbook is not installed in the environment, so the full book build cannot run; I’m completing a final repository/diff audit instead.
   Implemented the HackTricks update.

Changes

• Added src/windows-hardening/lateral-movement/wsus-external-database-relay-update-injection.md
  • WSUS discovery
  • WSUS machine-account NTLM relay to MSSQL
  • webService stored-procedure permission enumeration
  • Parent/child update injection workflow
  • Digest-to-URL mapping
  • Selective target-group deployment
  • Integrity/signature and identifier-consistency caveats
• Added navigation links to:
  • src/windows-hardening/lateral-movement/README.md
  • src/SUMMARY.md
• Included numbered citations to the original SpecterOps research and primary supporting sources.

Validation

• Internal links resolve.
• Citation numbering and page format pass.
• git diff --check passes.
• Forbidden sources are absent.
• External references return HTTP 200.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-1

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening → Lateral Movement → WSUS Update Server Abuse, with cross-references to NTLM relay and 1433 - Pentesting MSSQL".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0