Windows Update can be abused to execute malicious files

guest · Oct 12, 2020

Windows Update can be abused to execute malicious files
October 12, 2020
https://www.bleepingcomputer.com/ne...ate-can-be-abused-to-execute-malicious-files/

The Windows Update client has just been added to the list of living-off-the-land binaries (LoLBins) attackers can use to execute malicious code on Windows systems.
Malicious code execution using malicious DLLs
The WSUS / Windows Update client (wuauclt) is a utility located at %windir%\system32\ that provides users partial control over some of the Windows Update Agent's functionality from the command-line.

Using the /ResetAuthorization option allows initiating a manual update check either on the locally configured WSUS server or via the Windows Update service according to Microsoft.
Click to expand...

However, MDSec researcher David Middlehurst discovered that wuauclt can also be used by attackers to execute malicious code on Windows 10 systems by loading it from an arbitrary specially crafted DLL with the following command-line options:

wuauclt.exe /UpdateDeploymentProvider [path_to_dll] /RunHandlerComServer
As seen in the screenshot above, the Full_Path_To_DLL is the absolute path to the attacker's specially crafted DLL file that would execute code on attach.

In this case, it does it by executing malicious code from a DLL loaded using a signed-Microsoft binary, the Windows Update client (wuauclt).
Click to expand...

xxJackxx · Oct 13, 2020

Doesn't it already execute malicious files every patch Tuesday?

Daveski17 · Oct 13, 2020

xxJackxx said: ↑

Doesn't it already execute malicious files every patch Tuesday?
Click to expand...

lol

Log in or Sign up

Windows Update can be abused to execute malicious files

guest Guest

xxJackxx Registered Member

Daveski17 Registered Member

Log in or Sign up

Windows Update can be abused to execute malicious files

guest Guest

xxJackxx Registered Member

Daveski17 Registered Member

Useful Searches