Why would one do this when storing a secure string? - powershell

Question

Would this in some way make it more secure than just a secure string and storing it in a credential? Why would someone do this?
$secVal = read-host -AsSecureString -prompt "Enter xstoreuser password"
$strVal = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secVal)
$dasPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($strVal)
and then later
psftp -l somelogin -pw $dasPassword -P 22 -b .\ftp.txt somehost

Answer 1

The technique you're showing is not about making the command more secure - on the contrary:
You need to do extra work to recover the plain-text password from the [securestring] instance, because in order to pass a password to an external program such as psftp.exe you need an insecure plain-text representation, because external programs know nothing about .NET secure strings.
How secure is SecureString? tells you about .NET secure strings and their limitations in general.
As an aside: The command for extracting the plain-text password can be simplified a little via an aux. [pscredential] instance:
# Returns the plain-text content of secure string $secVal:
(New-Object pscredential somelogin, $secVal).GetNetworkCredential().Password
The only secure approach is to avoid plain-text passwords altogether and use a PKI approach (based on public and private keys) instead, if supported by the target program.
To demonstrate that the plain-text approach is insecure (even without the use of an intermediate variable to store the unencrypted password):
# Create a [pscredential] instance with a secure-string password:
# Note: To make this demo self-contained, I'm converting *from* plain
# text in order to construct the credential object.
# Note that you should never do that in production code.
# The need to specify -Force to do it is a reminder that it
# normally shouldn't be done.
$cred = New-Object pscredential someuser,
(ConvertTo-SecureString -AsPlainText -Force 'actualPassword')
# Open a new hidden window that passes the password *as plain text* to
# `cmd /c echo` (and then waits for a keypress, to keep the process alive).
$ps = Start-Process -PassThru -WindowStyle Hidden cmd "/c echo $($cred.GetNetworkCredential().Password) & pause"
# Now inspect the process' command line using CIM (WMI):
(Get-CimInstance Win32_Process -Filter "ProcessID = $($ps.ID)").CommandLine
# Kill (stop) the sample process.
$ps | Stop-Process
The above yields "C:\WINDOWS\system32\cmd.exe" /c echo actualPassword & pause, demonstrating that the plain-text password can indeed be obtained by other processes.
You can also use GUI methods for inspecting a running process' command line: Task Manager (Taskmgr.exe) or, without potential truncation, SysInternals' Process Explorer (procexp.exe), which, however, must be installed on demand - see this ServerFault answer.