WSL2 for pentesting – My experience
Hello all!
I think it has been one month since I started using WSL2 for my CTF activities, and I have tested it in different environments.
With this article I want to share my experience, hoping it will be useful to you, the reader.
WSL2 Overview
For those who don’t know WSL2, it’s the second version of a product made by Microsoft that allows you to use Linux inside Windows.
Here is the description from Microsoft:
Developers can access the power of both Windows and Linux at the same time on a Windows machine. The Windows Subsystem for Linux (WSL) lets developers install a Linux distribution (such as Ubuntu, OpenSUSE, Kali, Debian, Arch Linux, etc) and use Linux applications, utilities, and Bash command-line tools directly on Windows, unmodified, without the overhead of a traditional virtual machine or dualboot setup.
Think of it as a Docker container in Windows.
You can:
- Navigate between both file systems using a Linux shell
- Modify files, create new ones, delete whatever you want from the Windows file system using the Linux shell. Some people don’t suggest doing this, but today I haven’t encountered any problems…yet.
- Share hardware resources, so cracking tools like John the Ripper and Hashcat work fine. For Hashcat, you need to install the correct drivers for the GPU and install CUDA. Online guides are easy to follow, but something went wrong for me, and I was too lazy to troubleshoot. I’m just using the Windows version of Hashcat.
- Run Windows executables from Linux. I use it for the Windows version of Hashcat.
- Save resources for something else, WSL is very lightweight!
- Do other cool things that are not coming in my mind at this moment…
WSL2 VS Other Hypervisors VS Dual Boot
I’ve included only the methods I personally used to run Linux.
Dual Boot
I started with Dual Boot, cool if you hate Windows, but sometimes you need to use it. Personally, I find Windows just fine.
Honestly, I don’t see a reason to use Linux in Dual Boot with Windows unless you have specific requirements (such as direct access to the hardware).
Then, another problem with the Dual Boot is the backups…what will you do if something breaks? Of course, you can do a lot of things but I’m lazy.
These are the reasons why I switched to virtualization.
Other Hypervisors
In my IT career, I have mainly used two hypervisors, VMware and VirtualBox.
I have also used others but for a very short period so I will not include them in this paragraph.
I used VirtualBox for 2/3 years, I started with it in High School. During that time, it always worked fine but when I started my career in Cybersecurity there was always something that was not working fine…
Not every day, but after a period of use, something inside my VM instance or VirtualBox would break.
Of course, you have snapshots and backups, but I was tired of losing data.
Also, the general speed was not comparable to a Dual Boot solution.
I’m not saying VirtualBox was slow; I’m just saying I wanted something faster.
Then I switched to VMware.
There, I found stability. Even today, after years, I haven’t broken my machine.
I like to give to my machines a bit of my personality, like I do with everything else, so I had:
- A cool terminal
- A stable machine
- Everything organized the way I wanted
What was the problem?
The speed was comparable to VirtualBox, and switch continuously between from Windows and VMware started to become a pain in the “59 58 4e 7a” .
I have two monitors, so with VMware I was always using both, but one day, a strange bug appeared in my VMware installation.
In particular, during my switching between displays, VMware was merging my two virtual displays into one, one above another, and I was not able to separate them. Only disabling the second display would work, but afterward, I couldn’t enable it again and I wanted it!
After a great amount of time spent troubleshooting, I gave up and left it like that.
During that time, I was watching some videos of the youtuber Lostsec, who was using WSL in his bug bounties activities.
I was fascinated by the idea of using a Linux shell inside Windows.
There was everything I wanted: speed, stability, customization….
After some time I decided to give WSL2 a try.
WSL2
The first week was spent understanding the environment and the best setup for me.
You can configure WSL2 in many ways. After all, it runs Hyper-V, so you can configure it as if you were using VMware or VirtualBox.
So far, it’s been great. I’ve used it for one month for many CTF challenges, and I’m loving it.
What I like about it:
- Stability (for now)
- Fast recovery (I tested the export and import functions)
- Speed
Initially, my problems were with networking.
Today you have four options.
- NAT
- Mirrored
- VirtioProxy
- Bridged (re-introduced with the version 2.5.6.0)
Initially, I was using the NAT configuration. With Windows, I was accessing labs through a VPN, but it was uncomfortable because I had to open ports and forward everything to the Kali WSL2 instance. I wanted to continue using Windows, and at the time, I wasn’t yet aware of WSLg.
Then I started using the Mirrored mode.
Basically, WSL2 mirrors all the network configurations from Windows, allowing it to share the NIC.
So: same IP, same MAC address; if you connect to a VPN, your traffic is automatically routed. Cool! That’s exactly what I was looking for , a complete symbiosis.
One problem: this feature is still under development, so in some scenarios, it doesn’t work properly.
During my activities, I couldn’t afford to keep troubleshooting network problems, there are already enough problems during pentesting or CTFs to solve…
So, I switched back to NAT. I also tried using the Bridge mode but it didn’t solve the port forwarding problem.
During this time, I discovered WSLg (Windows Subsystem for Linux GUI). It allows you to use applications that require a GUI, handling the X server for you in the background (if you install WSL2 in Windows 11 it’s already automatically configured).
Since today it’s still not possible to have a complete network symbiosis between Linux WSL2 and Windows, I suggest simply using the NAT configuration and running the apps that require a GUI when you need them. Of course, I connect to the VPN directly from WSL2.
You can also install a complete GUI environment, but when you already have your terminal and can open GUI apps without problems, it doesn’t really make sense to have an entire GUI environment [although I tried it, and it’s pretty cool (no double screen)]. The only bad thing is that it’s not so easy to position the windows opened with WSLg. Microsoft, I’m waiting for the mirrored mode fixes. 😉
Conclusions
This article is not intended to make you leave your favorite hypervisors. After talking to a lot of people, it seems like I’m the only one who had all these problems! Ahaha.
I just wanted to share my experience. Probably others have had bad experiences with WSL, but I’m having an amazing one! I hope this time it will be durable…
