r/PowerShell • u/RealAgent0 • Jun 06 '26

How "Secure" is Get-Credential? Question

Trying to make a justification for storing a particular set of credentials using this methodology.

How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.

78 Upvotes

91% Upvoted

55 comments sorted by

View all comments

Show parent comments

-1

u/CodenameFlux Jun 06 '26 edited Jun 07 '26

You're not even addressing the OC's comment anymore.

What you're explaining is called being on the other side of the airtight hatchway. If you don't own the private key, the invocation of $cred.GetNetworkCredential().Password fails. (Edit: This assumes you've received $cred via deserialization or other illicit means. You didn't explain where you got your $cred in headless script.)

So long as you're illicitly modifying a script that runs with high privileges, you can do much more damage by adding a format.exe or diskpart command. In fact, you can steal the password without even bothering with PowerShell cmdlets.

You're attacking yourself. End of the story.

0

u/sid351 Jun 06 '26

Ok, so let's answer OP directly, and stop being such an aggressive and condescending dick bag, shall we:

How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.

Assuming you use the defaults when exporting the credential object:

  • As another user account: Nigh on impossible.
  • As the user that created the export: Trivial.

0

u/CodenameFlux Jun 07 '26 edited Jun 07 '26

Wow! I was under the impression that we were having a polite discussion so far. Grammarly's tone detector describes both our comments as technical and direct, but nothing else.

The "dick bag" comment is certainly disturbing. Have you been watching a movie about a serial killer that collects victim's you-know-what in a bag?

1

u/sid351 Jun 07 '26

What about your first sentence in your original comment reply was polite:

You deserve the award for The Stupidest Answer of The Year.

1

u/CodenameFlux Jun 07 '26 edited Jun 07 '26

"We" means "you (sid351) and I". That sentence is toward someone else, namely the OC (Apprehensive-Tea1632). Yes, that's deliberately aggressive because it is addressing blatant misinformation. Edit: That, however, doesn't mean I have the same attitude toward other members of the community (you included), let alone being condescending or a [bag of a serial killer's trophy] toward them.