Repository navigation
PyWSUS is broken on recent Windows 10/11 and Windows Server 2016/2019/2022 #17
Description
Hi, for about a year I haven't been able to get PyWSUS to work.
Tested across multiple targets (Windows 10 (> 23H2), Windows 11, Server 2019, Server 2022) with the same result: the client syncs, but the provided executable/command is never run and the update is never applied.
Command used
pywsus.py --host "192.168.140.1" --port 8530 \
--executable /opt/resources/windows/SysinternalsSuite/PsExec64.exe \
--command '/accepteula /s cmd.exe /c "echo wsus.poc > C:\poc.txt"'
Actual behaviour
-
Client performs SOAP sync (HTTP 200) but does not execute the payload.
-
No
C:\poc.txtcreated on targets. -
On the Windows Update UI the install attempt shows error
0x80240013
`INFO:root:The update metadata - uuids: [UUID('3a8e3507-4f11-4750-9557-4270fbff22ca'), UUID('4289eeeb-1308-44b9-9bad-3d3e4c138741')],revision_ids: [965752, 983499], deployment_ids: [84285, 87395], executable: PsExec64.exe, sha1: AJjHnhQEtDmb8OaG2I2/BSJpowI=, sha256: 7frhppUi+HsSxtrDIl2TDkhIgy48VR7h59MXNr9FJe8=
INFO:root:Starting httpd...
192.168.140.20 - - [03/Oct/2025 08:04:29] "POST /ClientWebService/client.asmx HTTP/1.1" 200 -
INFO:root:SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
192.168.140.20 - - [03/Oct/2025 08:04:41] "POST /ClientWebService/client.asmx HTTP/1.1" 200 -
INFO:root:SOAP Action: "http://www.microsoft.com/SoftwareDistribution/Server/ClientWebService/SyncUpdates"
Environment
-
pywsus: latest from repo (cloned recently)
-
Recent updated Targets: Windows 10, Windows 11, Server 2019, Server 2022
-
Payload executable: Sysinternals
PsExec64.exe -
Network: no firewall blocking between pywsus server and targets (SOAP requests reach clients)
It looks like this repository hasn’t had any commits for ~3 years, so I’m wondering if the tool is no longer maintained or compatible with newer Windows builds.
I also tried to patch/debug the code myself, but despite several different attempts I couldn’t get it to work.
If anyone is willing to try patching this, feel free to reach out, I can help on the testing/exploitation side.
Activity
fsoc106 commentedon Oct 28, 2025
same here
5tuk0v commentedon Feb 27, 2026
I was seeing the same in my lab with different Windows versions. I had a go at it with our friend Claude and got to something that seems to work out-of-the-box with Win10/11/2019/2022 most times. No clue if its going to be merged or not but feel free to check it out #18
nitbx commentedon Feb 27, 2026
Hello everyone,
Sorry for the delay in responding. I no longer work at this company; however, I’ve reviewed the issue and the proposed bug fixes, and they look very interesting.
I will relay this to the internal team at GoSecure to see whether someone would like to take the lead on it.
If there is no internal follow-up, I can also try to validate the proposed fix in my own lab environment and provide feedback on my own fork.
Thank you!
archidote commentedon Feb 27, 2026
Hï @nitbx
Thank you for your message.
On my side, I am currently working on a patch with a colleague. This is part of our 2026 TODO roadmap, and we plan to move forward on it soon.
If we uncover any significant findings during our reverse engineering efforts, we will share them here.
5tuk0v commentedon Apr 3, 2026
Hey there, not sure if there are multiple issues here with multiple root causes, but I dug into a specific issue that could be similar to @archidote's. I have posted the details here: NeffIsBack/wsuks#17. These are the same changes I propose in #18.
pgrenaud commentedon Jul 2, 2026
Since we just merged a big update that should fix compatibility issues with recent Windows versions, I will close this issue for now. Please reply here if you are still experiencing this issue after updating to the last version of PyWSUS.
pgrenaud commentedon Jul 2, 2026
Fixed by #19