Reverse SSH shell to WSL2

Reverse SSH shell to WSL2

WLS2 is configured by default in a NAT network.That means we can't generally reach it from the outside. 

To connect to it externally, let us configure WSL 2 for reverse shell

Prerequisite

• Another SSH server that acts as gateway. This server should be accessible from the outside. For this exercise we will be using 192.168.2.30 as the gateway IP.
  

Step 1: Enable SSH on WSL2

$: sudo ssh-keygen -A

Then start SSH:

$: sudo service ssh start

Step 2: Verify connection from WSL2 to the gateway SSH server

$: ssh -R 2222:localhost:22 u1@192.168.2.30

Below is an example connection to Kali SSH server

From Kali gateway server, verify that we can connect to port 2222, like:

$: ssh u2@localhost -p 2222

By default WSL2 does not allow SSH connection using password, you will get an error like below.

u2@localhost: Permission denied (publickey).

To fix this, change /etc/ssh/sshd_config on WSL2, ensure that: 

• PasswordAuthentication is set to yes
• ChallengeResponseAuthentication is set to no
  

And restart SSH, like so:

$: sudo service ssh restart

Let us try to open the tunnel again, on WSL2 run:

$: ssh -R 2222:localhost:22 u1@192.168.2.30

Now go back to the gateway server and do:

$: ssh u2@localhost -p 2222

You should now be able to connect to the WSL2 from the gateway like below

Step 3: Use public/private key to connect

Providing the password everytime we establish a connection gets really tiring, so let us use public/private key for the connection.
Let us start from WSL2 to the gateway, generate private/public key pair on WSL2:

$: ssh-keygen -t rsa -b 2048

Then copy id_rsa.pub to the gateway, like:

$: cat ~/.ssh/id_rsa.pub | ssh u1@192.168.2.30 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Now, if you re-run the command to create a tunnel, it should just connect without asking for password, like:

$: ssh -R 2222:localhost:22 u1@192.168.2.30

Next up is connection from the gateway to WSL2. Let us generate private/public key on the gateway, like:

$: ssh-keygen -t rsa -b 2048

Then copy id_rsa.pub to the WSL2, like:

$: cat ~/.ssh/id_rsa.pub | ssh u2@localhost -p 2222 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Now we are making progress.

Step 4: Create the tunnel when WSL2 is started

It is probably best for the tunnel that was created to require no interaction, so we run it like:

$: ssh -R 2222:localhost:22 u1@192.168.2.30 -N

Or better yet, run it in a background

$: ssh -R 2222:localhost:22 u1@192.168.2.30 -N &

Now to invoke this on WSL start, we need to ensure that SSH server is started and then create the tunnel. We don't want sudo to ask for the password when starting the service, so let us allow running sudo without password for the default account (u2).

$: sudo visudo

Then add the following:

u2 ALL=(ALL) NOPASSWD: ALL

Do save and exit in Nano (Ctrl+S followed by Ctrl+X).
Then add the following to ~/.bashrc, do this towards the end of the file:

sudo service ssh status
if [ $? -ne 0 ]; then
  echo "Starting"
  sudo service ssh start
  echo "tunnel"
  nohup ssh -R 2222:localhost:22 u1@192.168.2.30 -N >/dev/null 2>&1 &
fi

Step 5: Connect to WSL2 via the gateway

Now for the fun stuff, to connect to WSL2 from getaway, we need to create another tunnel!!! This time ssh client will listen on port 2222 locally, any connection to that port will be tunneled to the gateway (192.168.2.30) on port 2222. Remember that port 2222 on the gateway was reverse tunnelled to port 22 on WSL2:

c:\> ssh -L 2222:localhost:2222 u1@192.168.2.30

So to finally connect to WSL2, do:

c:\> ssh u2@localhost -p 2222

WSL2: Ubuntu fails to start ssh server

WSL2: Ubuntu fails to start ssh server
Running sudo service ssh start fails with error message like below:

* Starting OpenBSD Secure Shell server sshd
sshd: no hostkeys available -- exiting.

It is failing because there are no keys generated in the system, to fix it do:

$: sudo ssh-keygen -A

You should now able to able to start it, like:

$: sudo service ssh start

Installing WSL2 on Windows Server 20H2

Installing WSL2 on Windows Server 20H2

Environment info

•  Host: Windows 10 Release 1909 Pro
• Virtualization: VMware Professional 14 Pro

 Prerequisite

•  Windows Server 20H2
• VMware Tools installed - mount the installer (Menu | Install VMware Tools...)
  

PS C:\>setup.exe /S /v "/qn REBOOT=R ADDLOCAL=ALL"
PS C:\>shutdown /t 0 /f /r

• Enable nested virtulization on the VM
  

Install WSL2 Ubuntu 20.04

PS C:\>dism.exe /online /enable-feature /featurename:Microsoft-Windows-Subsystem-Linux /all /norestart
PS C:\>dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart
PS C:\>shutdown /t 0 /f /r
PS C:\>#Wait for the reboot to complete
PS C:\>Invoke-WebRequest https://wslstorestorage.blob.core.windows.net/wslblob/wsl_update_x64.msi -OutFile $HOME\Downloads\wsl_update_x64.msi
PS C:\>cd $HOME\Downloads
PS C:\>msiexec.exe /i wsl_update_x64.msi /quiet /qn
PS C:\>wsl --set-default-version 2
PS C:\>curl.exe -L -o ubuntu-2004.zip https://aka.ms/wslubuntu2004
PS C:\>md C:\Distros\Ubuntu2004
PS C:\>Expand-Archive ubuntu-2004.zip C:\Distros\Ubuntu2004
PS C:\>cd C:\Distros\Ubuntu2004
PS C:\>.\ubuntu2004.exe

You will be prompted to install and create a user account in Ubuntu. And you should be all set. 

To open wsl2 again, do:

PS C:\>.\wsl.exe -d Ubuntu-20.04

Keywords:(WSL2, Ubuntu, VMware Workstation)