Unable to retrieve secret as plain text

[janegilring]

❯ Get-Secret -Name 'Some secret' -AsPlainText  -Vault lastpass -Verbose
VERBOSE: Invoking command Get-SecretInfo on module SecretManagement.LastPass.Extension
VERBOSE: Secret information was successfully retrieved from vault lastpass.
VERBOSE: Invoking command Get-Secret on module SecretManagement.LastPass.Extension
VERBOSE: Secret Some secret was successfully retrieved from vault lastpass.

UserName                                                      Password
--------                                                      --------
admin@somedomain.onmicrosoft.com                     System.Security.SecureString

For some reason I am unable to retrieve Lastpass secrets as plain text. Can someone reproduce the issue, or is it an error on my side?

❯ gmo *Secret* | select name,version

Name                                  Version
----                                  -------
Microsoft.PowerShell.SecretManagement 1.0.0
Microsoft.PowerShell.SecretStore      1.0.0
SecretManagement.LastPass             0.2.1

❯ $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.1.3
PSEdition                      Core
GitCommitId                    7.1.3
OS                             Microsoft Windows 10.0.19043
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[sba923]

For now I'm using this workaround (source):

[System.Runtime.InteropServices.Marshal]::PtrToStringAnsi([System.Security.SecureStringMarshal]::SecureStringToCoTaskMemAnsi((ConvertTo-SecureString -String ((Get-Secret -AsPlainText foo).Password | ConvertFrom-SecureString) -Force)))

[TylerLeonhardt]

I'm gonna need some help with this extension since I don't use lastpass anymore :(

[sba923]

Oh... missed that this was the LastPass provider for SecretManagement... The workaround works like a charm with KeePass 😋

So, sorry, I can't help...

[muchohot]

You can store the secret in a variable, and then use the ConvertFrom-SecureString cmdlet on the Password property of that variable with the switch -AsPlainText to see the password.

Example:

$mySecret = Get-Secret -Name "Some secret"
ConvertFrom-SecureString $mySecret.Password -AsPlainText

This will only work if $mySecret is of type Selected.System.Management.Automation.PSCredential, which has a Password property of type System.Security.SecureString

Let me know if this helps!

[sba923]

I have written a wrapper for this:

# Get-SecretPasswordAsPlainText.ps1
param([Parameter(Mandatory = $true)][string] $Name, [string] $Vault)

[System.Runtime.InteropServices.Marshal]::PtrToStringAnsi([System.Security.SecureStringMarshal]::SecureStringToCoTaskMemAnsi((ConvertTo-SecureString -String ((Get-Secret -AsPlainText -Name $Name -Vault $Vault).Password | ConvertFrom-SecureString) -Force)))