Stealing Private Data

gistfile1.ps1

$module = New-Module -Name "monkey" -ScriptBlock {
  $credentials = Get-Credential
  function Get-Files($source) {
    New-PSDrive -Name target -PSProvider FileSystem -Credential $credentials -Root "$target" | Out-Null
    $results = Get-ChildItem -Path target:\ -Recurse -Force | % { $_.Name }
    Remove-PSDrive target
    return $results
  }
  Export-ModuleMember Get-Files
}

try {
  Import-Module $module -Global -Force
  $loadedModule = Get-Module monkey # we could use $module here, but this is showing that we can pull loaded modules.
  $stolenCredentials = (. $loadedModule { $credentials } )
  # or load the data into the parent scope
  #$stolenCredentials = $null
  #. $loadedModule {
  #  Set-Variable -Name stolenCredentials -Scope 1 -Value $credentials
  #}
  if($stolenCredentials.UserName -ne $null) {
    Write-Output "I've got the golden ticket."
    Write-Output "Nice password: $($stolenCredentials.GetNetworkCredential().Password)"
  }
  # We could invoke this, but the code was just for show
  #Get-Files "C:\some\path" | Out-Null
} finally {
  Remove-Module [m]onkey
}

Monkey.psd1

@{

# Script module or binary module file associated with this manifest.
RootModule = 'Monkey.psm1'

# Version number of this module.
ModuleVersion = '1.0'

# ID used to uniquely identify this module
GUID = '4d4390dc-a8ad-4bce-8d69-f53ccf8e4163'

# Author of this module
Author = 'Ian Davis'

# Copyright statement for this module
Copyright = '(c) 2015 Ian Davis. All rights reserved.'


# Functions to export from this module
FunctionsToExport = 'Update-Credentials', 'Get-Files'

# Variables to export from this module
VariablesToExport = $null

}

Monkey.psm1

function Update-Credentials($cred) {
  if($cred) {
    $script:credentials = $cred
  } else {
    $script:credentials = Get-Credential
  }
}

function Get-Files($source) {
  New-PSDrive -Name target -PSProvider FileSystem -Credential $credentials -Root "$target" | Out-Null
  $results = Get-ChildItem -Path target:\ -Recurse -Force | % { $_.Name }
  Remove-PSDrive target
  return $results
}

Monkey.tests.ps1

Describe "Update-Credentials" {
  Context "Funtion Sets private credentials" {
    Import-Module (Join-Path $PSScriptRoot Monkey.psd1)
    $username = "domain01\admin01"
    $password = ConvertTo-SecureString "secret" -asplaintext -force
    $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $password
    Update-Credentials $cred
    $module = $null
    BeforeEach { $module = Get-Module "Monkey" }
    AfterEach { Remove-Module [m]onkey }
    It "Should be possible to steal the data" {
      $stolenCredentials = (. $module { $credentials } )
      $($stolenCredentials.GetNetworkCredential().Password) | Should Be "secret"
    }
  }
}