Microsoft WSUS Deserialization RCE

A critical insecure deserialization vulnerability in Microsoft Windows Server Update Services (WSUS) that has been actively exploited to deploy the ShadowPad backdoor.

## Vulnerability Overview
WSUS is Microsoft's enterprise update management solution, used by organizations to distribute Windows updates to thousands of endpoints. This vulnerability allows an unauthenticated attacker to execute arbitrary code with SYSTEM privileges on the WSUS server by sending a maliciously crafted serialized object through the WSUS SOAP API.

## Technical Details
- **Type:** Insecure Deserialization (CWE-502)
- **Root Cause:** The WSUS SOAP API endpoint deserializes untrusted .NET BinaryFormatter payloads without proper type validation. An attacker can craft a serialized object chain (gadget chain) that executes arbitrary commands upon deserialization.
- **Privilege Level:** SYSTEM — the WSUS service runs as NT AUTHORITY\SYSTEM
- **Known Gadget Chains:** TypeConfuseDelegate, PSObject, and custom WindowsIdentity chains

## Real-World Exploitation
- APT groups have been observed using this vulnerability to deploy the ShadowPad backdoor.
- The ShadowPad payload was delivered as a fake WSUS update package, which was then distributed to all WSUS clients.
- Estimated 15,000+ vulnerable WSUS servers exposed to the internet.

## Impact
- Complete WSUS server compromise with SYSTEM privileges
- Ability to push malicious "updates" to all managed Windows endpoints
- Lateral movement across the entire Windows domain
- Perfect vector for supply chain attacks within an organization