Check for insecure WSUS configuration

[MexHigh]

Pingcastle does not check for insecure WSUS configurations (like when using HTTP or allowing the usage of a user-defined proxy after the January 2021 cumulative update). WSUS should be configured to use HTTPS and TLS cert pinning.

[vletoux]

I’ll be happy if you can describe the high level algorithm (checks to be performed, ms doc, .. ) that you expect to be implemented.

[MexHigh]

Ok, will do it until Saturday, thanks

[MexHigh]

WSUS clients can be attacked to perform a local privilege escalation by injecting installation files and instructions into the Windows Update response of the WSUS server with the help of a proxy.

Attack vector 1: user proxies

Background

Unprivileged domain users may set a user proxy that is used for this purpose. Since the cumulative updates from September 2020 and January 2021, WSUS clients do not use the user proxy to connect to the server by default. However, it is possible to configure a GPO setting that allows the connection via user proxy as a fallback to the system proxy.

There are tools that can even intercept HTTPS connections, but it is a good idea to enforce HTTPS anyways (due to network related attacks).

Things to check:

• Setting "Set the intranet update service for detecting updates" and "Set the alternate download server" in GPO Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location should not contain http://. (refers to registry key HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\WUServer and HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\UpdateServiceUrlAlternate)
• Setting "Select the proxy behavior for Windows Update client for detecting updates" in GPO Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location should be set to "Only use system proxy for detecting updates (default)". (refers to registry key HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\SetProxyBehaviorForUpdateDetection == 0x0 or not existent)

Attack vector 2: disabled TLS certificate pinning

Background

Even though HTTPS makes it harder for attackers to intercept WSUS responses, it it still possible with a specific configuration. HTTPS connections may be intercepted by a proxy that signs the response again with a self-signed certificate after receiving it from the WSUS server. The certificate can be installed in a user cert store so responses from the HTTPS proxy can still be validated.

In the cumulative update of January 2021, Microsoft implemented a certificate pinning mechanism where the certificate served by the WSUS' IIS server is installed in a system cert store specifically for WSUS (WindowsServerUpdateServices) that an unauthenticated user cannot control. Certificates in this store are enforced by default to mitigate HTTPS-intercepting proxy attacks but this pinning mechanism can also be disabled via GPO.

If the WSUS cert store does not contain any certificates, the pinning will not be enforced, too. But I don't know if Pingcastle is able to check which certificates are installed on the client computers.

Things to check:

• Setting "Do not enforce TLS certificate pinning for Windows Update client for detecting updates" in GPO Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location should be unticked (default). (refers to registry key HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection == 0x0 or not existent)
• Ensure that at least one certificate is installed in the system certificate store WindowsServerUpdateServices (if this is possible)

Docs and references

• https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#configure-ssl-on-the-wsus-server
• https://www.gosecure.net/blog/2020/09/08/wsus-attacks-part-2-cve-2020-1013-a-windows-10-local-privilege-escalation-1-day/
• https://book.hacktricks.xyz/windows/windows-local-privilege-escalation#wsus

Working tools

• https://github.com/GoSecure/WSuspicious
• https://github.com/pimps/wsuxploit

[vletoux]

Personal note: See https://www.gosecure.net/blog/2021/11/22/gosecure-investigates-abusing-windows-server-update-services-wsus-to-enable-ntlm-relaying-attacks/

[vletoux]

First version completed. Can you contact me via support@pingcastle.com to see if the version matches the requirements ? Thanks

I designed 4 rules, whose one is displayed below