Windows Server Update Service Deserialization Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_windows/http/wsus_deserialization_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits a deserialization vulnerability (CVE-2025-59287) in Windows Server Update Services (WSUS) to achieve remote code execution as administrator. It crafts a malicious SOAP event containing a serialized payload, which triggers unsafe deserialization during server synchronization.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2025-59287, a deserialization vulnerability in WSUS. It uses the framework's DotNetDeserialization utility to generate a payload, sends it in a crafted SOAP request, and waits for server synchronization to trigger execution. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareWindows Server Update Services (WSUS)
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a fully implemented exploit that actively sends crafted HTTP requests to trigger a deserialization vulnerability and execute an attacker-supplied payload on the target. It includes a check method but its primary purpose is exploitation.

modules/exploits/windows/http/wsus_deserialization_rce.rb:6modules/exploits/windows/http/wsus_deserialization_rce.rb:141-145modules/exploits/windows/http/wsus_deserialization_rce.rb:209-219

Requirements

  • Target must be running a vulnerable version of WSUS on port 8530.modules/exploits/windows/http/wsus_deserialization_rce.rb:33
  • Attacker must wait for WSUS to synchronize (default WfsDelay 900 seconds) for the payload to execute.modules/exploits/windows/http/wsus_deserialization_rce.rb:34

Observed behavior

  • Sends a SOAP request to retrieve the WSUS server ID.modules/exploits/windows/http/wsus_deserialization_rce.rb:68-85
  • Obtains an authorization cookie from the SimpleAuthWebService.modules/exploits/windows/http/wsus_deserialization_rce.rb:87-106
  • Retrieves encrypted reporting parameters (cookie) from the ClientWebService.modules/exploits/windows/http/wsus_deserialization_rce.rb:108-137
  • Generates a serialized payload using the WindowsIdentity gadget chain and SoapFormatter.modules/exploits/windows/http/wsus_deserialization_rce.rb:141-145
  • Crafts a malicious ReportEventBatch SOAP request containing the serialized payload in the SynchronizationUpdateErrorsKey field.modules/exploits/windows/http/wsus_deserialization_rce.rb:147-190
  • Sends the malicious event to the ReportingWebService, which will be deserialized during the next WSUS synchronization, executing the payload.modules/exploits/windows/http/wsus_deserialization_rce.rb:192-195
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
Msf::Util::DotNetDeserialization.generate(payload.encoded, gadget_chain: :WindowsIdentity, formatter: :SoapFormatter)The module generates a deserialization payload using the standard Metasploit framework utility, which is expected behavior for an exploit module.modules/exploits/windows/http/wsus_deserialization_rce.rb:141-145
Payload Delivery
SynchronizationUpdateErrorsKey=#{Rex::Text.html_encode(payload_data)}The generated payload is embedded in a SOAP request field, which is the intended delivery mechanism for the exploit.modules/exploits/windows/http/wsus_deserialization_rce.rb:178
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include the implementation of Msf::Util::DotNetDeserialization or the WindowsIdentity gadget chain.
  • The module's behavior during execution (e.g., network traffic, payload delivery) is inferred from the source code and was not observed.
  • The review covers only the module source code; the behavior of included Metasploit mixins (e.g., Exploit::Remote::HttpClient, Msf::Util::DotNetDeserialization) is not expanded or analyzed.
  • The actual payload executed is determined by the user at runtime and is not part of this module's static analysis.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1