Recently at the PowerShell Summit, Lee Holmes and I did a talk on PowerShell security. One of the demonstrations we did showed how to find and exploit a command injection bug in a constrained runspace. I figured I’d write a short blog post on how to use a command injection bug to turn a constrained runspace in to an unconstrained runspace.
more here.............http://clymb3r.wordpress.com/2014/06/25/cracking-open-powershells-constrained-runspace/
more here.............http://clymb3r.wordpress.com/2014/06/25/cracking-open-powershells-constrained-runspace/