Escalation Path via Windows Subsystem for linux(WSL)

The Windows Subsystem for Linux(WSL) is a powerful feature in Windows that allows users to run Linux Distribution natively. However, if misconfigured, it can be a vector for privilege escalation or unauthorized execution of commands

---

Finding WSL Binaries

to locate the binaries associated with WSL on a windows system, tou can use the followinf commands:

1. Finding bash.exe

bash.exe was used in earlier version of WSL (WSL 1) as the entry point before WSL 2 was introduced.

where /R c:\windows bash.exe

2. Finding wsl.exe (WSL2)

The modern wsl.exe command is used for WSL2, which runs the Linux kernel on windows

---

How WSL can be abused for privilege escalation

1. WSL with Sudo (Escalation via WSL)

If WSL is configured to run as an elevated user, it can be used as a priviled escalation tool. Commands like sudo allows attackers to execute commands as root inside the WSL enviornment, which may lead to system compromise.

1. Abusing WSL to bypass Execution Policy

Running Linux-based payloads through WSL may bypass Windows execution policies such as AppLocker or Windows Defender Application Control(WDAC), if not configured correctly. This could allow an attacker to execute unauthorized or malicious code

1. Accessing Windows File through WSL

WSL provides access to windows file system through mounted directories (/mnt/c, /mnt/d). This could be leveraged to manipulate files in system directories like C:\Windows\System32, which may lead to further exploitation

1. WSL vulnerabilities in Older Versions

WSL 1 has known issues with privilege escalation, and an attacker could exploit these vulnerabilities if the system is running an outdated version of WSL. Ensure WSL 2 is used for better isolation and security

---