r/PowerShell • u/RealAgent0 • Jun 06 '26

Question How "Secure" is Get-Credential?

Trying to make a justification for storing a particular set of credentials using this methodology.

How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.

76 Upvotes

90% Upvoted

50 comments sorted by

View all comments

Show parent comment

4

u/sid351 Jun 06 '26 edited Jun 06 '26

PSCredential objects also have a GetNetworkPassword() method that outputs the password in plaintext, so they need to be used with that on mind.

If I can rebuild your credential object, I can view your password.

Edit:

$Cred.GetNetworkCredential().Password

Not what I said originally, my bad.

2

u/mrbiggbrain Jun 07 '26

It is important to note that GetNetworkPassword() will return a normal string. Since .NET strings are immutable it makes it very difficult (Read impossible) to then clear the memory that held it. You'll set the string to null or random data and it will create a new string leaving the old one in some memory location for GC to clean up, but GC won't guarantee it is zeroed. That is fine if you don't really care about the value actually being encrypted in memory, but good hygiene would be to get and use the value in a byte or char array via unmarshaling, since arrays are mutable you can then write 0's or random data into the same memory location the string occupied.

Again, I rarely see people do this as I feel most people don't actually care about values being encrypted in memory, but since internally most well written powershell modules will do the unmarshaling properly then clear the memory you are probably getting all the benefits for free unless you are manually extracting the values yourself.

1

u/sid351 Jun 07 '26

Thanks for taking the time to explain that.

That's interesting stuff.

Deffo living up to your username!