Buying Internal Domain Access Again

This research demonstrates that predictable WSUS/update server hostnames can be abused by registering those names in public DNS and responding to client HTTP requests with an NTLM challenge, allowing capture of NTLM hashes from Windows Update clients (including possible machine account hashes). The author documents setup, observed requests, use of Responder with multi-port listening, potential impacts (offline cracking, privilege escalation, Kerberos ticket creation), and a responsible disclosure timeline with Microsoft.