How to encrypt my program config file using PowerShell to prevent users from seen the content?

Question

I have a small config file for a program that this code creates, the file is created by converting the $Data variable into Json format txt file and reads back from it.
I would like the file to be encrypted and still be able to decrypt and read from it.

$path = "test.txt"

$Data = @{
   File = "test.exe"
   Folder = "c:\temp\"
   count = "4"  
}

$Data | ConvertTo-Json | Add-Content  -Path $path
$NewData = Get-Content -Path $path -Raw | ConvertFrom-Json
$NewData.File
$NewData.Folder
$NewData.count

Any suggestions on how to add simple encryption and decryption?
Maybe using ConvertTo-SecureString.. I tried but cant get it to work (not even close).

Start by identifying which (kind of) attacker you're trying to protect it from. — Lasse V. Karlsen
– Lasse V. Karlsen, Commented Jul 7, 2021 at 18:08
Do you want to prevent tampering or prevent anyone knowing what's in it? Or both? — Scepticalist
– Scepticalist, Commented Jul 7, 2021 at 18:26
The easiest resource I can imagine is Export-CliXml, the file can only be read by your user and only on the computer it was exported. — Santiago Squarzon
– Santiago Squarzon, Commented Jul 7, 2021 at 22:36
Good one @Santiago. I didn't know that one. Have some scripts to update now. — alexzelaya
– alexzelaya, Commented Jul 8, 2021 at 1:15
The idea is to simply make the config file idiot proof. The program i am writing is a small tool that will help some of my "computer literate" colleagues and i dont want them to try and edit it. — Maxim N.G.
– Maxim N.G., Commented Jul 9, 2021 at 0:00

marc_s · Accepted Answer · 2021-07-10 16:06:02Z

I want to thank @santiago-squarzon and all who contributed to this post.

After a VERY long night of trial and error basically attempting to translate the Microsoft c# examples and snippets to PowerShell I finally found a working solution.

Also a big thank you to

Luke Orellana for this article https://www.altaro.com/msp-dojo/encrypt-password-powershell/
Adam Bertram for this eye opening article https://mcpmag.com/articles/2017/07/20/save-and-read-sensitive-data-with-powershell.aspx

Here is the final solution for anyone that wants to do it like me!

$tempfolder = $env:temp
$tmpkey = {110
52
114
225
64
235
208
235
242
44
101
16
80
94
97
252} | Set-Content $tempfolder\newkey.key     # I have generated this 16 byte random key using key generation script 
                                              # with the help from " https://www.altaro.com/msp-dojo/encrypt-password-powershell/ ""
$key = Get-Content $tempfolder\newkey.key 


$file = "test.txt"

$Data = @{
   File = "test.exe"
   Folder = "c:\temp\"
   count = "4"  
}

$perm = $data | ConvertTo-Json
$perm |  ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString -key $key |  Set-Content -Path $file

#  this encrypted the data into my test.txt file no to show how it looks inside
$tmp = Get-Content -path $file
echo $tmp


#  now to retrieve it and convert back to usable text
  
$NewData = Get-Content  -Path $file | ConvertTo-SecureString -key $key
$LoadedData = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR((($NewData)))) | ConvertFrom-Json
$LoadedData.File
$LoadedData.Folder
$LoadedData.Count

Collectives™ on Stack Overflow

How to encrypt my program config file using PowerShell to prevent users from seen the content?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related