Reverse SSH shell to WSL2

WLS2 is configured by default in a NAT network.That means we can't generally reach it from the outside.

To connect to it externally, let us configure WSL 2 for reverse shell

Prerequisite

Another SSH server that acts as gateway. This server should be accessible from the outside. For this exercise we will be using 192.168.2.30 as the gateway IP.

Step 1: Enable SSH on WSL2

$: sudo ssh-keygen -A

Then start SSH:

$: sudo service ssh start

Step 2: Verify connection from WSL2 to the gateway SSH server

$: ssh -R 2222:localhost:22 u1@192.168.2.30

Below is an example connection to Kali SSH server

From Kali gateway server, verify that we can connect to port 2222, like:

$: ssh u2@localhost -p 2222

By default WSL2 does not allow SSH connection using password, you will get an error like below.

u2@localhost: Permission denied (publickey).

To fix this, change /etc/ssh/sshd_config on WSL2, ensure that:

PasswordAuthentication is set to yes
ChallengeResponseAuthentication is set to no

And restart SSH, like so:

$: sudo service ssh restart

Let us try to open the tunnel again, on WSL2 run:

$: ssh -R 2222:localhost:22 u1@192.168.2.30

Now go back to the gateway server and do:

$: ssh u2@localhost -p 2222

You should now be able to connect to the WSL2 from the gateway like below

Step 3: Use public/private key to connect

Providing the password everytime we establish a connection gets really tiring, so let us use public/private key for the connection.
Let us start from WSL2 to the gateway, generate private/public key pair on WSL2:

$: ssh-keygen -t rsa -b 2048

Then copy id_rsa.pub to the gateway, like:

$: cat ~/.ssh/id_rsa.pub | ssh u1@192.168.2.30 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Now, if you re-run the command to create a tunnel, it should just connect without asking for password, like:

$: ssh -R 2222:localhost:22 u1@192.168.2.30

Next up is connection from the gateway to WSL2. Let us generate private/public key on the gateway, like:

$: ssh-keygen -t rsa -b 2048

Then copy id_rsa.pub to the WSL2, like:

$: cat ~/.ssh/id_rsa.pub | ssh u2@localhost -p 2222 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Now we are making progress.

Step 4: Create the tunnel when WSL2 is started

It is probably best for the tunnel that was created to require no interaction, so we run it like:

$: ssh -R 2222:localhost:22 u1@192.168.2.30 -N

Or better yet, run it in a background

$: ssh -R 2222:localhost:22 u1@192.168.2.30 -N &

Now to invoke this on WSL start, we need to ensure that SSH server is started and then create the tunnel. We don't want sudo to ask for the password when starting the service, so let us allow running sudo without password for the default account (u2).

$: sudo visudo

Then add the following:

u2 ALL=(ALL) NOPASSWD: ALL

Do save and exit in Nano (Ctrl+S followed by Ctrl+X).
Then add the following to ~/.bashrc, do this towards the end of the file:

sudo service ssh status
if [ $? -ne 0 ]; then
  echo "Starting"
  sudo service ssh start
  echo "tunnel"
  nohup ssh -R 2222:localhost:22 u1@192.168.2.30 -N >/dev/null 2>&1 &
fi

Step 5: Connect to WSL2 via the gateway

Now for the fun stuff, to connect to WSL2 from getaway, we need to create another tunnel!!! This time ssh client will listen on port 2222 locally, any connection to that port will be tunneled to the gateway (192.168.2.30) on port 2222. Remember that port 2222 on the gateway was reverse tunnelled to port 22 on WSL2:

c:\> ssh -L 2222:localhost:2222 u1@192.168.2.30

So to finally connect to WSL2, do:

c:\> ssh u2@localhost -p 2222

8thString

Search This Blog