wsuks

Automates a WSUS machine-in-the-middle attack from a Linux host against a Windows client on the local network. wsuks redirects the client's WSUS traffic and serves a crafted update that executes a Microsoft-signed binary (PsExec64.exe by default) and a PowerShell script as SYSTEM, creating a local administrator account or adding a supplied user to the local Administrators group. The normal HTTP mode requires the client to use a known WSUS server; HTTPS interception is also supported when a certificate valid for the WSUS server is supplied.