public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-12-14 14:16:22 +01:00
Code Issues Projects Releases Wiki Activity

Wsl and bash (#468)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Liran Ravich
2025-12-07 00:02:52 +02:00
committed by GitHub
parent f793a4d5c9
commit 005c784dab
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
yml/OSBinaries/Bash.yml
View File

@@ -40,6 +40,15 @@ Commands:
OperatingSystem: Windows 10 OperatingSystem: Windows 10
Tags: Tags:
- Execute: CMD - Execute: CMD
- Command: bash.exe
Description: When executed, `bash.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.
Usecase: Execute a payload as a child process of `bash.exe` while masquerading as WSL.
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 10, Windows Server 2019, Windows 11
Tags:
- Execute: CMD
Full_Path: Full_Path:
- Path: C:\Windows\System32\bash.exe - Path: C:\Windows\System32\bash.exe
- Path: C:\Windows\SysWOW64\bash.exe - Path: C:\Windows\SysWOW64\bash.exe
@@ -49,8 +58,10 @@ Detection:
- IOC: Child process from bash.exe - IOC: Child process from bash.exe
Resources: Resources:
- Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
- Link: https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
Acknowledgement: Acknowledgement:
- Person: Alex Ionescu - Person: Alex Ionescu
Handle: '@aionescu' Handle: '@aionescu'
- Person: Asif Matadar - Person: Asif Matadar
Handle: '@d1r4c' Handle: '@d1r4c'
- Person: Liran Ravich, CardinalOps

11
yml/OtherMSBinaries/Wsl.yml
View File

@@ -38,6 +38,15 @@ Commands:
Privileges: User Privileges: User
MitreID: T1105 MitreID: T1105
OperatingSystem: Windows 10, Windows Server 2019, Windows 11 OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe
Description: When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder.
Usecase: Execute a payload as a child process of `bash.exe` while masquerading as WSL.
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 10, Windows Server 2019, Windows 11
Tags:
- Execute: CMD
Full_Path: Full_Path:
- Path: C:\Windows\System32\wsl.exe - Path: C:\Windows\System32\wsl.exe
Detection: Detection:
@@ -47,6 +56,7 @@ Detection:
Resources: Resources:
- Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
- Link: https://twitter.com/nas_bench/status/1535431474429808642 - Link: https://twitter.com/nas_bench/status/1535431474429808642
- Link: https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
Acknowledgement: Acknowledgement:
- Person: Alex Ionescu - Person: Alex Ionescu
Handle: '@aionescu' Handle: '@aionescu'
@@ -57,3 +67,4 @@ Acknowledgement:
- Person: Nasreddine Bencherchali - Person: Nasreddine Bencherchali
Handle: '@nas_bench' Handle: '@nas_bench'
- Person: Konrad 'unrooted' Klawikowski - Person: Konrad 'unrooted' Klawikowski
- Person: Liran Ravich, CardinalOps