Private/Unprotect-HDTShareSecret.ps1
|
function Unprotect-HDTShareSecret { <# .SYNOPSIS Recovers the share password Protect-HDTShareSecret stored. .DESCRIPTION The other half of the obfuscation: base64 in, the first 16 bytes are the IV, the rest is AES-CBC ciphertext under the module constant from Get-HDTShareSecretKey. This is the half that runs inside WinPE, which is why the key cannot be user- or machine-bound. See Protect-HDTShareSecret. .PARAMETER Protected The base64 value written into Control\share-credential.json. .OUTPUTS System.String .EXAMPLE Unprotect-HDTShareSecret -Protected $document.password #> [CmdletBinding()] [OutputType([string])] param( [Parameter(Mandatory = $true, Position = 0)] [ValidateNotNullOrEmpty()] [string] $Protected ) Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' $blob = [System.Convert]::FromBase64String($Protected) $aes = [System.Security.Cryptography.Aes]::Create() try { $aes.Key = Get-HDTShareSecretKey $iv = New-Object -TypeName 'System.Byte[]' -ArgumentList 16 [System.Array]::Copy($blob, 0, $iv, 0, 16) $aes.IV = $iv $decryptor = $aes.CreateDecryptor() try { $plain = $decryptor.TransformFinalBlock($blob, 16, $blob.Length - 16) return [System.Text.Encoding]::UTF8.GetString($plain) } finally { $decryptor.Dispose() } } finally { $aes.Dispose() } } |