WSUS Is SUS NTLM Relay Attacks in Plain Sight

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/wsus-is-sus-ntlm-relay-attacks-in-plain-sight
• Blog Title: WSUS Is SUS: NTLM Relay Attacks in Plain Sight
• Suggested Section: Generic Methodologies & Resources > Pentesting Network > Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks (add a subsection: Abusing WSUS HTTP (8530) for NTLM Relay to LDAP/SMB/AD CS ESC8)

🎯 Content Summary

Overview. The post shows how commonplace WSUS traffic can be abused for credential capture and NTLM relay on local networks. WSUS clients authenticate to WSUS over HTTP (8530/TCP) or HTTPS (8531/TCP) using NTLM; by intercepting HTTP and standing up a WSUS-like listener, you can relay machine/user authentications to SMB/LDAP/LDAPS/AD CS without cracking hashes. WSUS was announced deprecated in September 2024 but remains widely deployed (still supported in Windows Server 2025),...

🔧 Technical Details

Abusing WSUS HTTP to harvest and relay NTLM. If WSUS uses HTTP (8530), ARP/DNS poison targets so their WSUS traffic hits your host, then run an HTTP-capable relay (ntlmrelayx) to forward NTLM authentications to LDAP/SMB/LDAPS/AD CS. Minimal setup: add a PREROUTING NAT rule for 8530, launch ntlmrelayx.py -t ldap://<DC> -smb2support -socks --keep-relaying --http-port 8530, and wait or force wuauclt.exe /detectnow. Expect machine accounts (e.g., HOST$) to appear as authenticated SOCKS sessions ready for post-exploitation (e.g., LDAP changes or ESC8 certificate issuance).

Rapid WSUS target discovery. Enumerate WUServer/WUStatusServer via SYSVOL GPO parsing (MANSPIDER + wsuspider.sh using regpol) or host-side registry queries (NetExec/<...

🤖 Agent Actions

I analyzed the TrustedSec post and the HackTricks repository, and I’ve added a focused subsection covering “Abusing WSUS HTTP (8530) for NTLM Relay to LDAP/SMB/AD CS (ESC8)” in the right place, with concrete commands and methodology. The content was not present before.

What I updated

• File updated: src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md
  • Added a new subsection “Abusing WSUS HTTP (8530) for NTLM Relay to LDAP/SMB/AD CS (ESC8)” under the NTLM relay section, right before “Force NTLM Logins.”
  • Included:
    • WSUS registry keys to look for (WUServer, WUStatusServer, UseWUServer, DetectionFrequencyEnabled, DetectionFrequency) and core HTTP SOAP endpoints (/ClientWebService/client.asmx and /ReportingWebService/reportingwebservice.asmx).
    • Recon steps:
      • Unauthenticated: nmap scan for 8530/8531 and sniffing HTTP WSUS traffic with wsusniff.py via L2 MITM.
      • Authenticated: GPO parsing via MANSPIDER + regpol using wsuspider.sh; at-scale host registry queries via NetExec and native reg query.
    • End-to-end exploitation steps for HTTP (8530):
      1. MITM positioning (e.g., arpspoof).
      2. iptables PREROUTING NAT for 8530.
      3. ntlmrelayx with HTTP listener: ntlmrelayx.py -t ldap:// -smb2support -socks --keep-relaying --http-port 8530
      4. Trigger client update: wuauclt.exe /detectnow (or Windows Update UI).
      5. Relay targets examples: LDAP/LDAPS/SMB and AD CS (ESC8) via ntlmrelayx --adcs to certsrv; socks for post-exploitation workflows.
    • HTTPS constraint: cannot passively abuse 8531 unless clients trust attacker cert.
    • Notes: WSUS deprecation status but real-world prevalence; Impacket HTTP listener support (PR #2034 and Update broken link in Golang SSTI references #913); helper tools.
    • Internal reference to AD CS domain escalation page for deeper ESC8 guidance (via ref macro).
  • References section updated with:
    • TrustedSec blog post.
    • GoSecure WSUS relay analysis.
    • Impacket PRs (#2034 and Update broken link in Golang SSTI references #913).
    • wsusniff.py and wsuspider.sh.
    • MS-WSUSOD specification and Microsoft WSUS deprecation note.

Why this change

• The “Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks” page is the ideal location for WSUS-based NTLM relay content since it consolidates relay vectors and MITM prerequisites. This WSUS HTTP relay technique was not previously documented there.
• The Windows local privilege escalation WSUS content focuses on malicious updates and CVE-2020-1013, but not on using WSUS HTTP as a source for NTLM relays to LDAP/SMB/AD CS.
• The AD CS page already has ESC8 abuse details; I linked to it for follow-on steps when targeting ESC8.

Repo exploration performed (at least 5 files read)

• src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md
• src/windows-hardening/ntlm/README.md
• src/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.md (contains ESC8 and related abuses)
• src/windows-hardening/windows-local-privilege-escalation/README.md (WSUS malicious update/CVE-2020-1013 content)
• src/generic-methodologies-and-resources/pentesting-network/README.md

References added

• WSUS Is SUS: NTLM Relay Attacks in Plain Sight (TrustedSec)
• GoSecure – WSUS NTLM relay analysis
• Impacket PR #2034 and Update broken link in Golang SSTI references #913
• WSUScripts (wsusniff.py and wsuspider.sh)
• Microsoft MS-WSUSOD protocol spec
• Microsoft WSUS deprecation announcement

Changes applied in repository

• Added the new WSUS HTTP abuse subsection and updated references:
  • Modified file: src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md

No new files were created; this fits within existing structure and avoids duplication.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

🗑️ File Cleanup

• searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/wsus-is-sus-ntlm-relay-attacks-in-plain-sight

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources > Pentesting Network > Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks (add a subsection: Abusing WSUS HTTP (8530) for NTLM Relay to LDAP/SMB/AD CS ESC8)".

Repository Maintenance:

• MD Files Formatting: 876 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0