Powershell 验证本地凭据

Question

因此，在我的脚本中，我不仅希望用户输入凭据并将其存储在变量中，而且能够验证密码是否与目标系统上的管理员密码匹配。到目前为止，我发现这样做的唯一方法是将未加密的实际密码放入脚本中，并将其与用户输入的密码进行比较。这是一个巨大的安全漏洞，为了解决这个问题，我想知道是否可以使用 gwmi 查询（SID？）作为对象获取管理员密码，并将其与用户输入的安全字符串进行比较。

这是我现在使用的有缺陷的代码。

Do
{
    $password = $null
    $password = read-host "Enter the Administrator Password" -assecurestring
    $AdminPass = ConvertTo-SecureString "adminpassword" -AsPlainText -Force
    $pwd1_text = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($password))
    $pwd2_text = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($AdminPass))
    if ($pwd1_text -cne $pwd2_text) {Write-Host -ForegroundColor Red "Incorrect Password"; $password = $null}
    $count ++
    $tries = 3 - $count
    if ($password -eq $null) {Write-Host -ForegroundColor Yellow "$tries Attempts Remaining"}
    if ($count -eq 3) {Write-Host -ForegroundColor Red "$count Unsuccessful Password Attempts. Exiting..."; exit} 
}While ($password -eq $null)
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist "$ComputerName\Administrator",$password

Answer 1

这是我编写的一个针对域或本地机器测试 PSCredential 对象的函数：

function Test-Credential {
<#
	.SYNOPSIS
		Takes a PSCredential object and validates it against the domain (or local machine, or ADAM instance).

	.PARAMETER cred
		A PScredential object with the username/password you wish to test. Typically this is generated using the Get-Credential cmdlet. Accepts pipeline input.
		
	.PARAMETER context
		An optional parameter specifying what type of credential this is. Possible values are 'Domain' for Active Directory accounts, and 'Machine' for local machine accounts. The default is 'Domain.'
	
	.OUTPUTS
		A boolean, indicating whether the credentials were successfully validated.

	.NOTES
		Created by Jeffrey B Smith, 6/30/2010
#>
	param(
		[parameter(Mandatory=$true,ValueFromPipeline=$true)]
		[System.Management.Automation.PSCredential]$credential,
		[parameter()][validateset('Domain','Machine')]
		[string]$context = 'Domain'
	)
	begin {
		Add-Type -AssemblyName System.DirectoryServices.AccountManagement
		$DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::$context) 
	}
	process {
		$DS.ValidateCredentials($credential.GetNetworkCredential().UserName, $credential.GetNetworkCredential().password)
	}
}

如果您想在远程机器上测试本地帐户，您需要在远程机器上加载此功能并通过远程处理（Invoke-Command）针对“本地”机器测试凭据，但它应该是可能。