I am attempting to easily ByPass
PowerShells ExecutionPolicy
. I realize one easy fix was to create runme.ps1
and script.ps1
and in runme.ps1
I can Bypass
the ExecutionPolicy
and call script.ps1
. Is there some way to put this in a "header" of a script and have it call itself while Bypass
ing the ExecutionPolicy
?
runme.ps1:
PowerShell.exe -ExecutionPolicy Bypass -File "C:\tmp\script.ps1"
script.ps1:
Write-Host "Hello World"
PAUSE
I'm currently working on some sort if "flag" or "tmpfile" logic and having the script call itself, but I wondered if there was a known/better way or even a possible way to have this be a header in all my scripts so end users can just "run w/ powershell" without prompts.
Addendum's to answer's with elaborations on ExecutionPolicy
are welcome, but let's focus on the question.
Discussions on ExecutionPolicy
should be focused on the "Security Stack Exchange" and the relevant post is linked here:
https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/:
However, it’s important to understand that the setting was never meant to be a security control. Instead, it was intended to prevent administrators from shooting themselves in the foot.
TLDR;
PowerShell.exe -ExecutionPolicy Bypass -File "C:\circumvent\industry\standard.ps1" 2>&1>$null
I wanted to share scripts and be able to say "right click and run w/ powershell" which is already worse then batch scripts where I say "double click the file" (people always get that one!).
The solution came to me because I had a PAUSE
in my main script to read console output and I noticed that after my main script called script.ps1
that I received an additional PAUSE
prompt from the "main/parent" script. Which made me realize, that the parent script was able to continue after calling child script. Ergo, call nonexistent script and pipe output to null!
& continue on merrily.
Example Scenario:
The following script wouldn't run via "right-click, Run w/ PowerShell" after a fresh reboot and I got the standard "Execution Policy Prompt":
script.ps1
Write-Host "Calling Scripts? No Problem!"
PAUSE
The following worked after a fresh reboot:
PowerShell.exe -ExecutionPolicy Bypass -File "C:\circumvent\industry\standard.ps1" 2>&1>$null
ECHO "This Script Won't Run Without Line 1"
ECHO "I had fun to try to circumvent an industry standard"
ECHO "I Learned a lot about PowerShell ExecutionPolicy"
C:\tmp\script.ps1
PAUSE
Result:
This Script Won't Run Without Line 1
I had fun to try to circumvent an industry standard
I Learned a lot about PowerShell ExecutionPolicy
Calling Scripts? No Problem!
Press Enter to continue...:
Update based on @BACON's comment, this is truly only possible with "run w/ powershell" via the "context menu". I tried setting "powershell" as the default app for .ps1
and not only did it not work, but the context menu removed the "run w/ powershell" option!
Thankfully, end users will have default settings and/or sysadmins will know how to resolve already.
Something I didn't test originally, but wanted to know how "circumventy" this solution really was is try using just PowerShell.exe -ExecutionPolicy Bypass
in the header. This resulted in the script not running, therefor it must be assigned a -File
but has no effect if File doesn't exist and allows script to continue executing.
But what runs that
PowerShell.exe
command? The trailing$null
suggests a PS script, so how is that run? The whole point of execution policies is to require the user/administrator to affirm their answer to "Are you sure you want to execute that?" by performing a deliberate, conscious act somewhere along the line. That could be executing a script's contents interactively, changing the policy, or overriding the policy, as you do with a newPowerShell.exe
instance. There's nothing being "circumvented" or "bypassed" here; this is just playing within the rules of how execution policies work.Right... Except I circumvented the whole "Are you sure you want to execute that?" prompt. I'm so confused how you could imagine this isn't circumventing anything.
But what runs that PowerShell.exe command? = "right click and run w/ powershell" @BACON
I didn't say it'd be a literal "Are you sure you want to execute that?" prompt. See
help about_Run_With_PowerShell
and the value ofHKEY_CLASSES_ROOT\SystemFileAssociations\.ps1\Shell\0\Command
to see how it works. ThatRun with PowerShell
is not the default action for a.ps1
file and requires the context menu comports with what I already said: "a deliberate, conscious act" by the user. The reason this isn't circumventing anything is because there's no escalation of privilege, these are documented features, and "circumvention" doesn't mean "things working exactly as designed."@BACON static.skaip.org/img/emoticons/180x180/f6fcff/headbang.gif