adel-hx0d/cve-2025-59287Exploitation toolkit for CVE-2025-59287 RCE in WSUS. Includes AES payload encryption and an exploitation module for authorized penetration testing.
CVE-2025-59287 - WSUS Exploitation Toolkit
by adel-h4x0a
⚠️ For Educational and Authorized Testing Purposes Only ⚠️
Overview
This toolkit demonstrates the exploitation of CVE-2025-59287, a remote code execution vulnerability in Windows Server Update Services (WSUS).
Components
· AES payload encryption for WSUS communication · Support for both legacy and secure encryption modes · Custom payload generation
· Full exploitation chain for CVE-2025-59287 · Robust error handling and retry logic · Custom payload support
Structure
📁 CVE-2025-59287-WSUS-Exploit/
├── 📄 cve-2025-59287-encr.py # Encryption module
├── 📄 cve-2025-59287-exp.py # Exploitation module
├── 📄 requirements.txt # Dependencies
└── 📄 README.md # This file
Usage
Prerequisites
pip install -r requirements.txt
Encryption
# Basic encryption
python cve-2025-59287-encr.py --command "calc" --mode legacy
# Encryption with custom key
python cve-2025-59287-encr.py --key "877C14E433638145AD21BD0C17393071" --command "whoami"
# Save output to file
python cve-2025-59287-encr.py --command "ipconfig" --output payload.txt
Exploitation
# Basic exploitation
python cve-2025-59287-exp.py http://wsus-server:8530
# With custom payload
python cve-2025-59287-exp.py http://192.168.1.100:8530 --payload custom_payload.txt
# With advanced settings
python cve-2025-59287-exp.py http://wsus-server:8530 --timeout 60 --retries 5
Options
Encryption Module (cve-2025-59287-encr.py)
· --key: AES key in hex format (optional)
· --command: Command to execute (default: calc)
· --mode: Encryption mode [legacy, secure] (default: legacy)
· --output: Output file to save payload (optional)
Exploitation Module (cve-2025-59287-exp.py)
· target: WSUS server URL (required) · --payload: Custom base64 payload file (optional) · --timeout: Request timeout in seconds (default: 30) · --retries: Number of retry attempts (default: 3) · --no-banner: Suppress banner display (optional)
Complete Example
# Generate custom payload
python cve-2025-59287-encr.py --command "whoami /all" --output custom_payload.txt
# Execute exploitation
python cve-2025-59287-exp.py http://wsus.internal.com:8530 --payload custom_payload.txt
Legal Disclaimer
❗ Important Warning:
This tool is provided for educational purposes and authorized penetration testing only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.
This tool should only be used in:
· Testing environments that you own · Systems for which you have obtained written permission to test · Educational and academic purposes
The developer is not responsible for any illegal or unauthorized use of this tool.
License
This project is licensed under the MIT License.
Updates
· v1.0: Initial release with full exploitation support · v1.1: Enhanced error handling and logging improvements
Contributing
Bug reports and pull requests are encouraged to improve the tool within the framework of responsible and ethical usage.
Note: Always obtain written permission before testing any system. Security awareness begins with responsibility. 🔒