WSUS abuse for privilege escalation

A local privilege-escalation proof of concept for CVE-2020-1013 in the Windows Update/WSUS client workflow. A low-privilege user's proxy and certificate trust settings can redirect update-client traffic to attacker-controlled metadata; GoSecure's WSuspicious creates a local proxy to attempt elevation, and its default PsExec64 payload runs a marker command as SYSTEM. The project reports testing only on Windows 10 builds 10.0.17763 and 10.0.18363. Microsoft patched CVE-2020-1013 in its September 2020 updates. This is not a general claim that writing arbitrary files to WsusContent creates an installable update.