How to automate Powershell's interactive Get-Credential method?

Question

I am trying to write a python script which automates the powershell's Get-Credential method. Here is something i wrote:

import subprocess
COMMAND_LINE = 'powershell'
powershell = subprocess.Popen(COMMAND_LINE, shell=True,
                                   stdin=subprocess.PIPE,
                                   stderr=subprocess.STDOUT,
                                   stdout=subprocess.PIPE)
output = powershell.stdout.readline()
print output.rstrip()
powershell.stdin.write('$cred = Get-Credential\n')
powershell.stdin.write('Administrator\n')
powershell.stdin.write('Password')
output = powershell.stdout.readline()
print output.rstrip()
out = powershell.communicate()[0]
print(out)

But i am unable to pass the password as above, i am getting following exception:

> PS /root> $cred = Get-Credential
> 
> Windows PowerShell credential request Enter your credentials. User:
> Administrator Password for user Administrator: PS /root>
> PasswordPassword : The term 'Password' is not recognized as the name
> of a cmdlet, function, script file, or operable program. Check the
> spelling of the name, or if a path was included, verify that the path
> is correct and try again. At line:1 char:1
> + Password
> + ~~~~~~~~
>     + CategoryInfo          : ObjectNotFound: (Password:String) [], CommandNot    FoundException
>     + FullyQualifiedErrorId : CommandNotFoundException

As i am new to python, Can anyone help me here?

score 5 · Answer 1 · answered Jul 21 '17 at 07:49

Your python problem is the \n after the commands, write already append a newline, so your script does the following:

$cred = Get-Credential # Start the command
# This line is ignored as extraneous after Get-Credential, but you can see it in your output.
Administrator # Send proprely to the User: prompt
# Sent to the Password: prompt
Password # Send to the shell input, causing the error at end of your log.

Now that's a quite hard way to automate the credential object in powershell, usually the object is build by other way like described in this blog post (quoting here for completeness):

$password = "mypassword" | ConvertTo-SecureString -asPlainText -Force
$username = "nwtraders\administrator" 
$credential = New-ObjectSystem.Management.Automation.PSCredential($username,$password)

And used as such:

Get-WMIObject win32_logicaldisk -ComputerName Server1 -Credential $credential

score 3 · Answer 2 · answered Nov 03 '17 at 01:18

I am by no means an expert but there is an alternative to creating a script containing 'plain text' passwords, which obviously isn't very secure.

I have written the following code snippet based on this article Who Are You? Or, Slipping By the Get-Credential Cmdlet by Jeff Hicks and now use this in order to automate a remote session.

# Create a secure string for the password
$Username = Read-Host "Enter Username"
$Password = Read-Host "Enter Password" -AsSecureString

# Create the PSCredential object
$Credentials = New-Object System.Management.Automation.PSCredential($Username,$Password)

# Server Variable
$Server = Read-Host "Enter Server Name"

# Create Remote Session
Enter-PSSession -ComputerName $Server -Credential $Credentials

When running this code, you will get the following output:-

PS Scripts:\> .\Snippets\Enter-SecureCreds.ps1
Enter Username: ##YOUR-USERNAME#
Enter Password: *************
Enter Server Name: 192.168.1.10

Password is obfuscated with * when entered.

As advised in Jeff's article

This credential only exists for as long as your PowerShell session is open. But be careful, because even though the password is stored as a secure string, if I have interactive access to the console session, I can still see the password by invoking the GetNetworkCredential() method:

PS S:\> $Credential.GetNetworkCredential()

UserName          Password          Domain
--------          --------          ------ 
admin             P@ssw0rd          mydomain

This isn't necessarily a security violation, unless you walk away and leave your session wide open for anyone to access. There may also be situations where you have a legacy application that can't use a PSCredential and you need to pass values like username and password to it. Just be aware.

IMPORTANT: It is a security no-no to hard-code any password in any plain text file. Ideally, you'll want to provide some secure mechanism for the script user to provide the necessary password. Also, don't forget to secure your console if you are keeping the credential object.

I hope you find this as useful as I have.

How to automate Powershell's interactive Get-Credential method?

2 Answers2