Secure string ?

[vaultdweller]

Hi everyone!

As many of you know, text strings are most oftenly visible in clear text if you open the EXE in an editor of some sorts. Now, the script I have needs run another .VBS script with "run as". I want to make sure a hacker can't parse the EXE and find out the login that is used in the run as part.

Is there anything like var$ = SecureString("This text shouldn't be visible in the EXE!")

Thanks!

Edited October 28, 2008 by vaultdweller

[Bert]

Could you transpose the VBS script to autoit?

[vaultdweller]

Could you transpose the VBS script to autoit?

Thanks for the reply, but either way the problem remains. It's for a login script, where Domain Users will have to impersonate another account to reach network resources that as themselves, they don't have any access to.

[TehWhale]

You could probably use a bunch of Chr() and mixing stuff so that it will return a secure string. I think I could do this so it's not easily readable but it can be read with effort.

[Szhlopp]

Hi everyone!

As many of you know, text strings are most oftenly visible in clear text if you open the EXE in an editor of some sorts. Now, the script I have needs run another .VBS script with "run as". I want to make sure a hacker can't parse the EXE and find out the login that is used in the run as part.

Is there anything like var$ = SecureString("This text shouldn't be visible in the EXE!")

Thanks!

bottom line, Autoit is NOT secure. You can decompile and de-obfuscate anything done in this language.

Your best bet is to write it in C++ and make a DLL with the varifcation process inside. It can still be decompiled, but it's a whole lot harder.

Option 2:

Create your own obfuscator. I've personally done this and it isn't all that hard. Again, it can be decompiled but if you make a custom obfuscator none of the current ones will work on it.

Hope this helps

[PsaltyDS]

Hi everyone!

As many of you know, text strings are most oftenly visible in clear text if you open the EXE in an editor of some sorts. Now, the script I have needs run another .VBS script with "run as". I want to make sure a hacker can't parse the EXE and find out the login that is used in the run as part.

Is there anything like var$ = SecureString("This text shouldn't be visible in the EXE!")

Thanks!

You can get some obsfucation of the data, but not hide it completely from a determined hacker. You could encrypt the string with _StringEncrypt() put the encrypted string in the script at compile time, and then have the script decrypt and use it at run time. But if the script is decompiled it will be possible to extract the pass phrase used to encrypt the original string, and then decrypt the string itself.

It's an old problem and there is no easy or totally secure answer. As a general rule: Do not hard code significant passwords in a script!

[Bert]

If they are Domain users, just make a AD group that gives them rights. That way you can avoid the issue you are having.

[vaultdweller]

yeah. I think I'll just make the account the script uses part of a specific group that is not part of the domain admins. That way, less arm if the password is found out.

thanks all!