samy4samy/cve-2025-59287-wsus-2Proof-of-concept exploit for CVE-2025-59287, a remote code execution vulnerability in Microsoft WSUS via unsafe deserialization. Sends crafted SOAP requests to trigger code execution under SYSTEM.
⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited.
CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS). It stems from unsafe deserialization of data inside WSUS components, allowing a remote, unauthenticated attacker to cause the service to deserialize a crafted .NET object and execute arbitrary code under the SYSTEM account. The vulnerability is commonly exploited by sending specially crafted SOAP requests to WSUS web endpoints. This repository was created to demonstrate a proof-of-concept for this vulnerability.
This PoC expects a payload serialized with .NET BinaryFormatter and encoded in Base64. If no payload is supplied, a benign calculator payload will be used instead. There are several ways to use a custom payload.
Simply insert your payload into payload.txt.
YOUR_PAYLOAD
The code will use payload from this file.
Second option: You can add your payload manually. Open exp.py and locate the following block. Replace 'your_payload' with your Base64-encoded .NET BinaryFormatter payload.
...
if not args.no_wait:
time.sleep(0.02)
injected = payload_text or 'your_payload'
success, event_id, target_sid = send_malicious_event(target, cookie, injected)
...
python exp.py http://example.local:8533
(replace http://example.local:8530 with the target WSUS server URL)
encrypt.py prepares a blob that looks like the encrypted/packed data WSUS expects; exp.py builds and sends SOAP requests that place that blob into WSUS fields which the vulnerable service will decrypt and deserialize — if the server is vulnerable the deserialized object can trigger code execution.
This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited.