dissect.target.plugins.child.wsl

Module Contents

Classes

WSLChildTargetPlugin

Child target plugin that yields WSL VHDX file locations.

Functions

find_wsl_installs

Find all WSL disk files.

dissect.target.plugins.child.wsl.find_wsl_installs(target: dissect.target.target.Target) → Iterator[pathlib.Path]

Find all WSL disk files.

Disk files for working (custom) Linux distributions can be located anywhere on the system. Locations to disk files for each user’s WSL instance is stored in the Windows registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss.

References

• https://learn.microsoft.com/en-us/windows/wsl/use-custom-distro

• https://learn.microsoft.com/en-us/windows/wsl/enterprise

class dissect.target.plugins.child.wsl.WSLChildTargetPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.ChildTargetPlugin

Child target plugin that yields WSL VHDX file locations.

Windows WSL VHDX disk file locations are stored in the Windows registry in HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss.

References

• https://www.osdfcon.org/presentations/2020/Asif-Matadar_Investigating-WSL-Endpoints.pdf

• https://www.sans.org/white-papers/39330/

• https://learn.microsoft.com/en-us/windows/wsl/disk-space#how-to-locate-the-vhdx-file-and-disk-path-for-your-linux-distribution

__type__ = 'wsl'

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

list_children() → Iterator[dissect.target.helpers.record.ChildTargetRecord]

Yield ChildTargetRecord records of all possible child targets on this target.