Powershell SecureString Encrypt/Decrypt To Plain Text Not Working

Question

We are trying to store a user password in the registry as a secure string but we can not seem to find a way to convert it back to plain text. Is this possible with SecureString?

Here is the simple test script we are trying to use...

Write-Host "Test Start..."
$PlainPassword = "@SomethingStupid" | ConvertTo-SecureString -AsPlainText -Force

$BSTR = ` [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($PlainPassword)
$PlainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
Write-Host "Password is: " $PlainPassword
Read-Host

This is the error we are getting...

The term ' [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR'
is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At C:\test.ps1:4 char:71
+ $BSTR = ` [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR
<<<< ($PlainPassword)
    + CategoryInfo          : ObjectNotFound: (
[System.Runtim...ureStringToBSTR:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

Cannot find an overload for "PtrToStringAuto" and the argument count: "1".
At C:\test.ps1:5 char:75
+ $PlainPassword =
[System.Runtime.InteropServices.Marshal]::PtrToStringAuto <<<< ($BSTR)
    + CategoryInfo          : NotSpecified: (:) [], MethodException
    + FullyQualifiedErrorId : MethodCountCouldNotFindBest

Ok, try actually putting the plaintext in its own string variable first like in the article I think you were looking at - social.technet.microsoft.com/wiki/contents/articles/… — Graham Gold
– Graham Gold, Commented Feb 12, 2014 at 23:26
Hmm - what OS, .NET and Powershell versions are you running? — Graham Gold
– Graham Gold, Commented Feb 12, 2014 at 23:58
Sorry you're right, the back tick was the issue. When I originally removed it I took the first character off the command and that was the unexpected token error. — devfunkd
– devfunkd, Commented Feb 13, 2014 at 4:01

Keith Hill · Accepted Answer · 2014-02-13 02:46:09Z

21

What is with the backtick in the $BSTR = ... line? I agree with Graham above. If I remove the backtick it work just fine:

$PlainPassword = "@SomethingStupid" | ConvertTo-SecureString -AsPlainText -Force
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($PlainPassword)
$PlainPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)
Write-Host "Password is: " $PlainPassword

Outputs:

Password is:  @SomethingStupid

You're not trying to run this on something like Windows RT or some other PowerShell configuration where the language is restricted - are you?

answered Feb 13, 2014 at 2:46

Keith Hill

204k44 gold badges370 silver badges377 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Adi Inbar · Accepted Answer · 2014-07-23 21:44:07Z

16

Here's a kludgy but much simpler way to decrypt a secure string, taking advantage of the fact that the PSCredential class has a constructor that accepts the password as a secure string and a method (GetNetworkCredential) that returns that password in plain text:

(New-Object System.Management.Automation.PSCredential 'N/A', $secure_string).GetNetworkCredential().Password

Although it's intended for use with credentials, there's nothing that prevents you from using this to decrypt any secure string* regardless of purpose, supplying a dummy argument for the username (the username argument can't be null or an empty string, but any meaningless string will do).

_{* Under the context of the account that encrypted the secure string to begin with, of course}

answered Jul 23, 2014 at 21:44

Adi Inbar

12.4k13 gold badges60 silver badges71 bronze badges

3 Comments

CloseISQ Over a year ago

Perfect. It allowed me to retrieve a previously ConvertTo-SecureString password stored in a file to then pass it to the Invoke-SqlCmd.

Baodad Over a year ago

What's "kludgy" about this? I can store a PS securestring in a database field, retrieve it, put it in a PSCredential object and use this method to decrypt it. Awesome!

Pecos Bill Over a year ago

It's not just account specific, but also machine unless you've used the -Key or -SecureKey options in ConvertFrom-SecureString to move it over. I love this because it's a one-liner.

Collectives™ on Stack Overflow

Powershell SecureString Encrypt/Decrypt To Plain Text Not Working

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related