Passing a Scriptblock with complex Arguments to a New Powershell Instance

Question

I want to execute the following script with complex arguments. For example with [securestring].

$text = "'This is a test message.'"

$ArgumentList = @( $text, $PID ) -join ", "
$cmd = { param([string]$msg, [int]$proc ); Write-Host "$msg FROM PID: $proc" }
$Command = "Invoke-Command -ScriptBlock {$cmd} -ArgumentList $ArgumentList"

Start-Process -Filepath powershell -ArgumentList "-noexit -command ( $Command )"

this script worked fine.
i`m transform this script into the new one

$text = "'This is a test message.'"
$Cred = get-credential
$ArgumentList = @( $text, $PID, $credential ) -join ", "
$cmd = { param([string]$msg, [int]$proc, $Credential ); Write-Host "$msg FROM PID: $proc, cred: $( $Credential.username )" }
$Command = "Invoke-Command -ScriptBlock {$cmd} -ArgumentList $ArgumentList"

Start-Process -Filepath powershell -ArgumentList "-noexit -command ( $Command )"

I have an error. How to pass arguments right?

Is it important to have the credential object available _inside_ the new process context? `Start-Process -Credential $cred` not sufficient? — Mathias R. Jessen, Jul 05 '22 at 10:42
I`m talking not about Credential parameter. Credential is nested scriptblock argument. — Alexey I. Kuzhel, Jul 05 '22 at 10:48
The credential object can't be "stringified", hence the error you receive. Please answer my question — Mathias R. Jessen, Jul 05 '22 at 10:49
You are right, i dont want to "stringify" credential. How to do it? — Alexey I. Kuzhel, Jul 05 '22 at 10:55

score 3 · Accepted Answer · edited Jul 05 '22 at 12:11

As suggested by @Mathias, I would consider to run the whole process under the specific credentials

Start-Process -Credential $cred -Filepath powershell -ArgumentList "-noexit -command ( $Command )"

Anyways, you might also serialize (all) your arguments and convert it to Base64 as you passing it trough multiple interpreters:

$text = "This is a test message."
$Cred = get-credential
$Arguments = @{
    Msg  = $Text
    Proc = $PID
    Cred = $Cred
}
$Serialized = [System.Management.Automation.PSSerializer]::Serialize($Arguments)
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($Serialized)
$Base64 =[Convert]::ToBase64String($Bytes)
$cmd = {
    param([String]$Base64)
    $Serialized = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($Base64))
    $Arguments = [System.Management.Automation.PSSerializer]::Deserialize($Serialized)
    Write-Host " $($Arguments.msg) FROM PID: $($Arguments.proc), cred: $( $Arguments.Cred.Username)"
}
$Command = "Invoke-Command -ScriptBlock {$cmd} -ArgumentList $Base64"

Start-Process -Filepath powershell -ArgumentList "-noexit -command ( $Command )"

Note: that Get-Credential by default uses the Windows data protection API, and the key used to encrypt the password is specific to both the user and the machine that the code is running under.

Thanks, Mathias! You read my mind, i`am also going this direction. — Alexey I. Kuzhel, Jul 05 '22 at 12:11

Passing a Scriptblock with complex Arguments to a New Powershell Instance

1 Answers1

Linked