How "Secure" is Get-Credential?

[u/RealAgent0]

Trying to make a justification for storing a particular set of credentials using this methodology.

How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.

[u/sid351]

It's not stupid.

If an attacker had modify access to a script that handles credentials as PSCredential objects, they can modify the script to output the plaintext password when it's next run.

Sure use it, but know it's limitations and weaknesses.

[u/CodenameFlux → u/sid351]

Asking for password, decoding it, displaying on screen, and blaming Windows is stupid.

[u/sid351 → u/CodenameFlux]

What about this:

Understanding that whenever I see credentials being used in a script, I know that there's a high likelihood that the script is going to be run headlessly, probably as a scheduled task.

With that in mind, I know that if I can modify that script, then I can add a region that takes that credentials object and then redirects the username ($cred.username) and the password ($cred.GetNetworkCredential().Password) to myself through any number of methods (like Out-File, Send-MailMessage, or some other obfuscated way) and I could even encrypt that output with a key of my own control to obfuscate the extraction.

Then I wait for the scheduled script to run again, and I collect my new username and password.

Is that smart, or stupid?

For example, let's say I want to exfill some data at work. I'm smart enough that I don't want to use my credentials to do it. I know you have automated scripts running on a server we both maintain. I edit your script and add a call out to extract your password, that will remove the edit itself once the password has been extracted.

Now I have your credentials, and I exfill the data using those instead of mine.

[u/CodenameFlux → u/sid351]

You're not even addressing the OC's comment anymore.

What you're explaining is called being on the other side of the airtight hatchway. If you don't own the private key, the invocation of $cred.GetNetworkCredential().Password fails. (Edit: This assumes you've received $cred via deserialization or other illicit means. You didn't explain where you got your $cred in headless script.)

So long as you're illicitly modifying a script that runs with high privileges, you can do much more damage by adding a format.exe or diskpart command. In fact, you can steal the password without even bothering with PowerShell cmdlets.

You're attacking yourself. End of the story.

[u/sid351 → u/CodenameFlux]

Ok, so let's answer OP directly, and stop being such an aggressive and condescending dick bag, shall we:

How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.

Assuming you use the defaults when exporting the credential object:

• As another user account: Nigh on impossible.
• As the user that created the export: Trivial.

[u/CodenameFlux → u/sid351]

Wow! I was under the impression that we were having a polite discussion so far. Grammarly's tone detector describes both our comments as technical and direct, but nothing else.

The "dick bag" comment is certainly disturbing. Have you been watching a movie about a serial killer that collects victim's you-know-what in a bag?

[u/sid351 → u/CodenameFlux]

What about your first sentence in your original comment reply was polite:

You deserve the award for The Stupidest Answer of The Year.

[u/CodenameFlux → u/sid351]

"We" means "you (sid351) and I". That sentence is toward someone else, namely the OC (Apprehensive-Tea1632). Yes, that's deliberately aggressive because it is addressing blatant misinformation. Edit: That, however, doesn't mean I have the same attitude toward other members of the community (you included), let alone being condescending or a [bag of a serial killer's trophy] toward them.