Prompt for credentials in ASP.NET / C# page, pass to PowerShell

蹲街弑〆低调 提交于 2020-07-19 19:03:55

问题


I'm looking to build a proof of concept / demo webpage that will:

  • Run as a service (no authentication required initially)
  • Prompt for credentials (i.e. to allow providing alternate credentials, ideally capture this as System.Management.Automation.PSCredential). No authentication is required here, I just need to capture the credentials.
  • Pass credentials in to PowerShell (e.g. shell.Commands.AddArgument(pscred) )
  • Use these credentials in PowerShell (pass in as, or convert to System.Management.Automation.PSCredential)
  • To clarify: I do not want to authenticate credentials. I just want to collect them in a secure way. For all I care at the moment, it is gibberish, but gibberish that I presumably want to protect

I have an ASP.NET Web Application project with Visual C# (similar to the one here). I have the page up and running (i.e. it runs with the appropriate account, it runs PowerShell, etc.) - I want to prompt for and store credentials in a reasonably secure manner. I assume there is some standard way to do this. Or am I reading too much into this as this is a server side application?

Here are excerpts from my code thus far:

  • Default.aspx (these will be changed depending on the scenario):

    <asp:TextBox ID="Input" runat="server" TextMode="MultiLine" Width="400px" Height="73px" ></asp:TextBox>  
    <asp:TextBox ID="InputParam" runat="server" TextMode="MultiLine" Width="200px" Height="20px" ></asp:TextBox>  
    <asp:Button ID="ExecuteCode" runat="server" Text="Execute" Width="200" onclick="ExecuteCode_Click" />
    <asp:TextBox ID="ResultBox" TextMode="MultiLine" Width="700" Height="200" runat="server"></asp:TextBox>
    <asp:TextBox ID="ErrorBox" TextMode="MultiLine" Width="700" Height="200" runat="server"></asp:TextBox>
    
  • Default.aspx.cs:

    protected void ExecuteCode_Click(object sender, EventArgs e)
    {
        // Clean the Result TextBox
        ResultBox.Text = string.Empty;
    
        // Initialize PowerShell engine
        var shell = PowerShell.Create();
    
        // Add the script and an argument to the PowerShell object
        shell.Commands.AddScript(Input.Text);
        shell.Commands.AddArgument(InputParam.Text);
    
        // Execute the script
        var results = shell.Invoke();
    
        // display results, with BaseObject converted to string
        // Note : use | out-string for console-like output
        if (results.Count > 0)
        {
            // We use a string builder ton create our result text
            var builder = new StringBuilder();
    
            foreach (var psObject in results)
            {
                // Convert the Base Object to a string and append it to the string builder.
                // Add \r\n for line breaks
                builder.Append(psObject.BaseObject.ToString() + "\r\n");
            }
    
            // Encode the string in HTML (prevent security issue with 'dangerous' caracters like < >
            ResultBox.Text = Server.HtmlEncode(builder.ToString());
        }
    
        //Collect errors
        var PSErrors = shell.Streams.Error.ReadAll();
    
        if (PSErrors != null)
        {
    
            // We use a string builder ton create our error text
            var builder = new StringBuilder();
    
            foreach (var psError in PSErrors)
            {
                // Convert the exception Object to a string and append it to the string builder.
                // Add \r\n for line breaks
                builder.Append(psError.Exception.ToString() + "\r\n");
            }
            // Encode the string in HTML (prevent security issue with 'dangerous' caracters like < >
            ErrorBox.Text = Server.HtmlEncode(builder.ToString());
        }
    
    }
    
  • This code won't work from what I understand, but the concept is exactly what I am looking to do.

    PSCredential pscred = this.Host.UI.PromptForCredential("Enter username/password","", "", "");
    shell.Commands.AddArgument(pscred);
    

回答1:


I think the easiest way is to use impersonation. i.e. you get the credentials of the user, and launch the powershell process as that user which allows you to execute anything you want as that user.

See:

Execute PowerShell cmdlets from ASP.NET With User Impersonation - Has steps to impersonate the current user to run PowerShell

or

How to run PowerShell scripts from ASP.NET with Impersonation - StackOverflow question on how to run PowerShell with impersonation.



来源:https://stackoverflow.com/questions/20410725/prompt-for-credentials-in-asp-net-c-sharp-page-pass-to-powershell

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!