{"id":4252,"date":"2012-04-30T10:57:00","date_gmt":"2012-04-30T18:57:00","guid":{"rendered":"http:\/\/www.sapien.com\/blog\/?p=4252"},"modified":"2012-04-30T10:58:05","modified_gmt":"2012-04-30T18:58:05","slug":"how-safe-are-credentials-in-script-packages","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2012\/04\/30\/how-safe-are-credentials-in-script-packages\/","title":{"rendered":"How safe are credentials in script packages?"},"content":{"rendered":"

We get that question all the time. Before we start, please note that we do not advise to ever<\/strong> put credentials as plain text into any kind of code. Use encrypted strings, store encrypted credentials in files or, if all else fails, prompt. Now, having said that we all know that sometimes schedules and pressure from \u201cabove\u201d forces you to do things you normally wouldn\u2019t do. So for the sake of argument we have created a variety of executables which use SUPERADMINUSER and SUPERSTRONGPASSWORD to run a WMI query on SUPERSECRETSERVER.<\/p>\n

We used <\/p>\n

    \n
  1. VBScript\n

    \"image\"<\/a> <\/p>\n

  2. PowerShell\n

    \"image\"<\/a> <\/p>\n

  3. C#\n

    \"image\"<\/a> <\/p>\n

  4. C++\n

    \"image\"<\/a> <\/p>\n<\/li>\n<\/ol>\n

    Obviously all of these won\u2019t run in your environment unless you create a server with that name and add those credentials.
    If you want to examine the resulting executable files yourself, go to     www.sapien.com\/download<\/a> and look for WMIQueryExecutables.zip in the \u201cBlog Samples\u201d folder.<\/p>\n

    Now we take all these files and open them in PrimalScript as binary files and look for the user id and password, starting with the C++ version.<\/p>\n<\/p>\n

    And here is your password, easily visible in the binary data:<\/p>\n

    \"image\"<\/a> <\/p>\n

    The spacing with NULL characters comes from the string being stored as unicode, so lets search for that in the C# version:<\/p>\n

    \"image\"<\/a> <\/p>\n<\/p>\n

    As you can see, we didn\u2019t have to look far. To make matters worse, if you take a disassembly tool to a .NET exe you don\u2019t even have to read binary data:<\/p>\n

    \"SNAGHTML9cb1335\"<\/a><\/p>\n

     <\/p>\n

    Now let\u2019s try the script packages created by PrimalScript:<\/p>\n

    \"image\"<\/a> <\/p>\n

    and<\/p>\n

    \"image\"<\/a> <\/p>\n

    So you see, if you have to, absolutely have<\/strong> to put credentials somewhere, a packaged script is the way to go.
    Go ahead, get the binaries and see for yourself. Here is where they are once again: Go to     www.sapien.com\/download<\/a> and look for WMIQueryExecutables.zip in the \u201cBlog Samples\u201d folder.<\/p>\n","protected":false},"excerpt":{"rendered":"

    We get that question all the time. Before we start, please note that we do not advise to ever put credentials as plain text into any kind of code. Use encrypted strings, store encrypted credentials in files or, if all else fails, prompt. Now, having said that we all know that sometimes schedules and pressure […]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[27,2,705,410,24,25],"tags":[99,707,556,708,373,28,706,709,996],"class_list":["post-4252","post","type-post","status-publish","format-standard","hentry","category-ask-the-experts","category-general","category-powershell-studio-2012","category-primalscript-software-news","category-vbscript","category-windows-powershell","tag-c","tag-disassembler","tag-encryption","tag-exeutable","tag-password","tag-powershell","tag-script-package","tag-username","tag-vbscript"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t