How can DotNetToJScript be used to execute PowerShell commands without powershell.exe?
By leveraging the PowerShell runspace environment within .NET, tools like StarFighters (by Cn33liz) can load PowerShell code via JS/VBS scripts without invoking powershell.exe. Base64-encode the PowerShell command or script and replace the `EncodedPayload` variable in StarFighter.js. This technique, detailed in Loading .Net Programs Using JS, bypasses application whitelisting and complements other PowerShell-less methods.
PowerShell runspaceStarFightersbase64 encodingbypass powershell.exeEmpire framework