> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/windows-subsystem-for-linux.md). # Windows Subsystem for Linux > With root privileges Windows Subsystem for Linux (WSL) allows users to create a bind shell on any port (no elevation needed). Don't know the root password? No problem just set the default user to root W/ `.exe --default-user root`. Now start your bind shell or reverse. - [Warlockobama's tweet](https://twitter.com/Warlockobama/status/1067890915753132032) ``` wsl whoami./ubuntun1604.exe config --default-user rootwsl whoamiwsl python -c 'BIND_OR_REVERSE_SHELL_PYTHON_CODE' ``` Binary `bash.exe` can also be found in `C:\Windows\WinSxS\amd64_microsoft-windows-lxssbash_[...]\bash.exe` Alternatively you can explore the `WSL` filesystem in the folder `C:\Users\%USERNAME%\AppData\Local\Packages\CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc\LocalState\rootfs\` ### Methodology **Check if bash and WSL exist** ``` where /R c:\windows bash.exe ``` * `where`: A Windows command-line utility used to locate files within the directory tree. * `/R`: This flag stands for Recursive. It tells the command to search the specified directory and all of its subdirectories. * `c:\windows`: The starting directory for the search. * `bash.exe`: The specific filename being searched for.
**Check if you are root**
``` wsl.exe whoami ``` **Jump into WSL with bash**
You can even find credentials in history files.
We can use PSexec to connect to machine.