--- title: Turning Enterprise Update Servers Into Backdoor... description: A red team research writeup details how WSUS deployments with a database hosted on a separate MSSQL server can be abused for lateral movement and persistence.... canonical: https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1 | daily.dev og:description: A red team research writeup details how WSUS deployments with a database hosted on a separate MSSQL server can be abused for lateral movement and persistence.... og:url: https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj og:image: https://api.daily.dev/og/posts/TpD5c86Dj.png og:image:alt: Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1 **[SpecterOps](https://daily.dev/sources/specterops)** · 15 min read · 0 upvotes · 0 comments ## Summary A red team research writeup details how WSUS deployments with a database hosted on a separate MSSQL server can be abused for lateral movement and persistence. By coercing the upstream WSUS computer account via NTLM relay (PetitPotam plus Ntlmrelayx) into a SQL session against the WSUS database, an attacker gains EXECUTE rights on stored procedures in the webService role even without direct table access. The post walks through the SPs needed to fabricate a malicious update - spImportUpdate, spSaveXmlFragment, spSetBatchURL, spGetFileLocations, target group creation SPs, and spDeployUpdate - showing how to build a bundled update, set fragment types (UpdateIdentity, LocalizedProperties, ExtendedProperties), point clients to an attacker-hosted payload, scope the attack to a specific target group, and force deployment. Part 2 promises to cover download and file-signature verification bypasses. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I abuse a WSUS server whose database is hosted on a separate MSSQL server for lateral movement? Coerce the upstream WSUS computer account to authenticate over SMB using a tool like PetitPotam, then relay that NTLM authentication with Ntlmrelayx into a SQL session against the WSUS SUSDB database. Even though the WSUS computer account typically only has EXECUTE rights via the webService database role rather than direct table access, those stored procedures (spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, spDeployUpdate) are enough to fabricate and deploy a malicious bundled update to a targeted computer group. _daily.dev surfaces research like this for teams hardening WSUS and Active Directory update infrastructure._ ### What stored procedures are required to inject a malicious update into the WSUS SUSDB database? Creating and deploying a fake WSUS update requires spImportUpdate to register the update XML metadata, spSaveXmlFragment called for UpdateIdentity, LocalizedProperties, and ExtendedProperties fragment types (six times total for a parent and child update pair), spSetBatchURL to point the file digest to an attacker-controlled download URL, spCreateTargetGroup and spAddComputerToTargetGroup to scope the attack, and finally spDeployUpdate to push and approve the update. _Track offensive research on Windows update infrastructure alongside daily.dev for defenders securing WSUS deployments._ ### Does the upstream WSUS server have administrative rights over a downstream WSUS server by default? No, testing found that coercing the upstream WSUS computer account via PetitPotam and relaying its NTLM authentication over SMB to a downstream WSUS server did not succeed, because the upstream server lacked administrative rights over the downstream server. The relay attempt against the separate WSUS MSSQL database succeeded instead, since the WSUS computer account had sufficient permissions there. _daily.dev keeps infrastructure defenders current on WSUS and Windows update security research._ ## Similar posts on daily.dev - [Threat Actors Achieve Persistence After SQL Injection](https://daily.dev/posts/threat-actors-achieve-persistence-after-sql-injection-cpfwbidol) · Huntress Blog · 5 upvotes · 0 comments - [HTB: Signed](https://daily.dev/posts/htb-signed-zkhb7xhv2) · 0xdf hacks stuff · 1 upvotes · 0 comments - [ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access](https://daily.dev/posts/shadowpad-malware-actively-exploits-wsus-vulnerability-for-full-system-access-t5bglj5jh) · The Hacker News · 0 upvotes · 0 comments - [Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability](https://daily.dev/posts/exploitation-of-knowledgedeliver-via-viewstate-deserialization-vulnerability-cdxn7gdbl) · Google Cloud · 0 upvotes · 0 comments --- Tags: [#active-directory](https://daily.dev/tags/active-directory), [#red-teaming](https://daily.dev/tags/red-teaming) [View this post on daily.dev](https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1","url":"https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj"},"datePublished":"2026-08-23T12:16:30.946Z","dateModified":"2026-08-23T12:16:59.038Z","description":"A red team research writeup details how WSUS deployments with a database hosted on a separate MSSQL server can be abused for lateral movement and persistence....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fd22ec6d9e2d635a1f67b6fecce3ff4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fd22ec6d9e2d635a1f67b6fecce3ff4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"active-directory,red-teaming","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/turning-enterprise-update-servers-into-backdoor-factories-0-o-part-1-tpd5c86dj#faq","mainEntity":[{"@type":"Question","name":"How can I abuse a WSUS server whose database is hosted on a separate MSSQL server for lateral movement?","acceptedAnswer":{"@type":"Answer","text":"Coerce the upstream WSUS computer account to authenticate over SMB using a tool like PetitPotam, then relay that NTLM authentication with Ntlmrelayx into a SQL session against the WSUS SUSDB database. Even though the WSUS computer account typically only has EXECUTE rights via the webService database role rather than direct table access, those stored procedures (spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, spDeployUpdate) are enough to fabricate and deploy a malicious bundled update to a targeted computer group. daily.dev surfaces research like this for teams hardening WSUS and Active Directory update infrastructure."}},{"@type":"Question","name":"What stored procedures are required to inject a malicious update into the WSUS SUSDB database?","acceptedAnswer":{"@type":"Answer","text":"Creating and deploying a fake WSUS update requires spImportUpdate to register the update XML metadata, spSaveXmlFragment called for UpdateIdentity, LocalizedProperties, and ExtendedProperties fragment types (six times total for a parent and child update pair), spSetBatchURL to point the file digest to an attacker-controlled download URL, spCreateTargetGroup and spAddComputerToTargetGroup to scope the attack, and finally spDeployUpdate to push and approve the update. Track offensive research on Windows update infrastructure alongside daily.dev for defenders securing WSUS deployments."}},{"@type":"Question","name":"Does the upstream WSUS server have administrative rights over a downstream WSUS server by default?","acceptedAnswer":{"@type":"Answer","text":"No, testing found that coercing the upstream WSUS computer account via PetitPotam and relaying its NTLM authentication over SMB to a downstream WSUS server did not succeed, because the upstream server lacked administrative rights over the downstream server. The relay attempt against the separate WSUS MSSQL database succeeded instead, since the WSUS computer account had sufficient permissions there. daily.dev keeps infrastructure defenders current on WSUS and Windows update security research."}}]} ```