PowerShell and built-in executable behavior

Mechanism

Built-in Windows tools can access networks, transform data, launch processes, and load components. Their availability can be useful in constrained CTF environments, but every capability depends on arguments, version, policy, and execution context. A tool catalogue is a discovery aid rather than a permission or impact guarantee.

Practical method

Identify the tool version and documented operation. Inspect argument parsing and destination paths. In a local fixture, test the smallest benign behavior and log the resulting process tree or file. For PowerShell, distinguish language mode, execution policy, and actual authorization boundaries.

$PSVersionTable
Get-Command certutil.exe
Get-Help Start-Process -Detailed

Interpreting evidence

Preserve the complete arguments and process identity. A successful transform or download does not imply elevated rights or a security-policy bypass.

Pitfalls and limits

Execution policy is not a general security boundary. Different host applications can embed different PowerShell runtimes. Public LOLBAS examples may require an argument form unavailable under the challenge policy.