{"id":3949,"date":"2013-03-26T00:01:00","date_gmt":"2013-03-26T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2013\/03\/26\/decrypt-powershell-secure-string-password\/"},"modified":"2013-03-26T00:01:00","modified_gmt":"2013-03-26T00:01:00","slug":"decrypt-powershell-secure-string-password","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/decrypt-powershell-secure-string-password\/","title":{"rendered":"Decrypt PowerShell Secure String Password"},"content":{"rendered":"

Summary<\/strong>: Microsoft Scripting Guy, Ed Wilson, shows how to easily decrypt the Windows PowerShell secure string password.<\/p>\n

\"Hey, Hey, Scripting Guy! We have an FTP site that I have to use on a regular basis. I need an easy way to get a credential and use that credential with the FTP site so that I can download a file that changes on a daily basis. I found a few scripts and functions on the Internet that will decrypt the secure string password from a Windows PowerShell credential object, but they all seem really complicated. Is there an easy way to do this?<\/p>\n

—AD<\/p>\n

\"Hey, Hello AD,<\/p>\n

Microsoft Scripting Guy, Ed Wilson, is here. Today I am sitting here drinking a cup of Earl Grey tea with a pinch of lavender in it. I love the way the two flavors complement each other. As I look over my email, I ran across your question. Although you did not include a link to the complicated versions <\/em>of the scripts and functions you ran across, I will venture to say that my method should be relatively painless.<\/p>\n

           Note<\/strong>   What I am showing here today is exactly by design, and is not a hack.<\/p>\n

Using Get-Credential for credentials<\/h2>\n

I love using the Get-Credential<\/strong> cmdlet to retrieve a credential object. It is already set up to work; and therefore, it is easy to use. If I need credentials, I do not need to mess around writing HTAs, creating various WinForms to prompt for a user name and password, or worry about how to mask the password—all of which were problems before Windows PowerShell and the Get-Credential<\/strong> cmdlet. So, like I say, I absolutely love it. To use the Get-Credential<\/strong> cmdlet, I generally store the resulting credential object in a variable. (I do not have to do so, because I can use it directly if I need to, but it is more flexible to store it in a variable.) Here is the command.<\/p>\n

$credential = Get-Credential<\/p>\n

When I run this command, a dialog box appears. The box is already set up to use, with a user name on the top, and it masks the password in the bottom box. The box is shown here.<\/p>\n

\"Image<\/a><\/p>\n

 The problem with Get-Credential<\/span><\/h2>\n

The problem with the Get-Credential<\/strong> cmdlet is that it returns a PSCredential<\/strong> object. In itself, this is not an issue, but it does mean that I can only use the credential object for cmdlets and for other items that know what a PSCredential<\/strong> object is. Not even all .NET classes know how to deal with a PSCredential object, so when it comes to connecting to legacy databases and things like websites and FTP sites, there is little hope of being able to use the object directly.<\/p>\n

Luckily, I can use the Get-Member<\/strong> cmdlet to look at the members of a PSCredential<\/strong> object. The members are listed here.<\/p>\n

PS C:\\> $credential | gm <\/p>\n

   TypeName: System.Management.Automation.PSCredential<\/p>\n

 <\/p>\n

Name                 MemberType Definition<\/p>\n

—-                 ———- ———-<\/p>\n

Equals               Method     bool Equals(System.Object obj)<\/p>\n

GetHashCode          Method     int GetHashCode()<\/p>\n

GetNetworkCredential Method     System.Net.NetworkCredential GetNetworkCredential()<\/p>\n

GetObjectData        Method     void GetObjectData(System.Runtime.Serialization.S…<\/p>\n

GetType              Method     type GetType()<\/p>\n

ToString             Method     string ToString()<\/p>\n

Password             Property   securestring Password {get;}<\/p>\n

UserName             Property   string UserName {get;}<\/p>\n

At first, it looks like things are relatively easy. If I want to see the user name, all I need to do is access the UserName<\/strong> <\/em>property as shown here.<\/p>\n

PS C:\\> $credential.UserName<\/p>\n

mydomain\\someuser<\/p>\n

That is cool. Now what about the password? When I access the Password<\/strong> <\/em>property, it returns SecureString<\/strong>. This is shown here.<\/p>\n

PS C:\\> $credential.Password<\/p>\n

System.Security.SecureString<\/p>\n

Hmmm, what if I look at the members of SecureString<\/strong>? I pipe it to the Get-Member<\/strong> cmdlet, and I see the following members.<\/p>\n

PS C:\\> $credential.Password | gm <\/p>\n

   TypeName: System.Security.SecureString<\/p>\n

 <\/p>\n

Name         MemberType Definition<\/p>\n

—-         ———- ———-<\/p>\n

AppendChar   Method     void AppendChar(char c)<\/p>\n

Clear        Method     void Clear()<\/p>\n

Copy         Method     securestring Copy()<\/p>\n

Dispose      Method     void Dispose(), void IDisposable.Dispose()<\/p>\n

Equals       Method     bool Equals(System.Object obj)<\/p>\n

GetHashCode  Method     int GetHashCode()<\/p>\n

GetType      Method     type GetType()<\/p>\n

InsertAt     Method     void InsertAt(int index, char c)<\/p>\n

IsReadOnly   Method     bool IsReadOnly()<\/p>\n

MakeReadOnly Method     void MakeReadOnly()<\/p>\n

RemoveAt     Method     void RemoveAt(int index)<\/p>\n

SetAt        Method     void SetAt(int index, char c)<\/p>\n

ToString     Method     string ToString()<\/p>\n

Length       Property   int Length {get;}<\/p>\n

Ok, cool. I will try the ToString<\/strong> <\/em>method and see what happens.<\/p>\n

PS C:\\> $credential.Password.ToString()<\/p>\n

System.Security.SecureString<\/p>\n

Well, that was less than illuminating…<\/p>\n

What if I try the Length<\/strong> <\/em>property? Does it give me anything?<\/p>\n

PS C:\\> $credential.Password.Length<\/p>\n

17<\/p>\n

It does.This is promising. I can at least write code that checks the length of the password and provides some sort of feedback to users regarding the length of the password they supply. It could be rather a cool solution.<\/p>\n

What if I use the ConvertFrom-SecureString<\/strong> cmdlet? This is a standard Windows PowerShell cmdlet, so I decide to pipe the password to the ConvertFrom-SecureString<\/strong> cmdlet. The following illustrates the output.<\/p>\n

PS C:\\> $credential.Password | ConvertFrom-SecureString<\/p>\n

01000000d08c9ddf0115d1118c7a00c04fc297eb0100000052ded6c2db80e748933432e19b9de8b10000<\/p>\n

000002000000000003660000c00000001000000016dc35885d76d07bab289eb9927cfc1e000000000480<\/p>\n

0000a0000000100000003106cde553f45b08d13d89d11336170b280000005cc865c1ee1b57e84ed3d1a2<\/p>\n

d3f2d0ec0f189b532e61c18d1f31444d6f119a1e8368477fd2d81f54140000000cb0262e58b08ae14f37<\/p>\n

22c14c69684841b6b21c<\/p>\n

This latest representation is a string, and therefore there are no more options available for decrypting the password—at  least, none that are very direct or easy to use.<\/p>\n

Get a network credential<\/h2>\n

The solution, is to go back to the PSCredential<\/strong> object itself. It has a method that is designed to help with the exact scenario. I need to provide credentials to a legacy type of interface that does not know how to handle a PSCredential<\/strong>. Therefore, I need to be able to get both the user name and the password in an easy-to-use and easy-to-digest manner. When I call the GetNetworkCredential <\/strong>method from the PSCredential<\/strong> object, it returns the user name and the domain name. This is shown here.<\/p>\n

PS C:\\> $credential.GetNetworkCredential() <\/p>\n

UserName                                           Domain<\/p>\n

——–                                           ——<\/p>\n

someuser                                           mydomain<\/p>\n

If I pipe the returned object to the Get-Member<\/strong> cmdlet, however, I see that I now have a NetworkCredential<\/strong> object. The members are listed here.<\/p>\n

PS C:\\> $credential.GetNetworkCredential() | gm <\/p>\n

   TypeName: System.Net.NetworkCredential<\/p>\n

 <\/p>\n

Name           MemberType Definition<\/p>\n

—-           ———- ———-<\/p>\n

Equals         Method     bool Equals(System.Object obj)<\/p>\n

GetCredential  Method     System.Net.NetworkCredential GetCredential(uri uri, str…<\/p>\n

GetHashCode    Method     int GetHashCode()<\/p>\n

GetType        Method     type GetType()<\/p>\n

ToString       Method     string ToString()<\/p>\n

Domain         Property   string Domain {get;set;}<\/p>\n

Password       Property   string Password {get;set;}<\/p>\n

SecurePassword Property   securestring SecurePassword {get;set;}<\/p>\n

UserName       Property   string UserName {get;set;}<\/p>\n

I see the password has a SecureString<\/strong> for the SecurePassword<\/strong> property, but there is also the Password<\/strong> property that is a plain string. So, I pipe the NetworkCredential<\/strong> object to the Format-List<\/strong> cmdlet and the following appears.<\/p>\n

PS C:\\> $credential.GetNetworkCredential() | fl * <\/p>\n

UserName       : someuser<\/p>\n

Password       : SomeUsersPassword<\/p>\n

SecurePassword : System.Security.SecureString<\/p>\n

Domain         : mydomain<\/p>\n

If I need only the password, I simply retrieve the Password<\/strong> <\/em>property as shown here.<\/p>\n

PS C:\\> $credential.GetNetworkCredential().password<\/p>\n

SomeUsersPassword<\/p>\n

By the way, I can also get the password length here. This is because all string objects contain a Length<\/strong> property. This is shown here.<\/p>\n

PS C:\\> $credential.GetNetworkCredential().password.length<\/p>\n

17<\/p>\n

AD, that is all there is to using the NetworkCredential<\/strong> object. Join me tomorrow when I will talk about more cool Windows PowerShell stuff.<\/p>\n

I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

Ed Wilson, Microsoft Scripting Guy<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy, Ed Wilson, shows how to easily decrypt the Windows PowerShell secure string password.  Hey, Scripting Guy! We have an FTP site that I have to use on a regular basis. I need an easy way to get a credential and use that credential with the FTP site so that I can […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[421,3,63,45],"class_list":["post-3949","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-passwords","tag-scripting-guy","tag-security","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy, Ed Wilson, shows how to easily decrypt the Windows PowerShell secure string password.  Hey, Scripting Guy! We have an FTP site that I have to use on a regular basis. I need an easy way to get a credential and use that credential with the FTP site so that I can […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/3949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=3949"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/3949\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=3949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=3949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=3949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}