From ec00518952383f794fd2bb3d9ccdb568eb1c70db Mon Sep 17 00:00:00 2001
From: Tomas Kracmar <tomas.kracmar@cqre.net>
Date: Wed, 29 Jul 2026 11:50:59 +0200
Subject: [PATCH] fix(passphrase): store DPAPI-protected, never plaintext or
 echoed

Elysium.ps1 used Read-Host without -AsSecureString (echoed the AES
passphrase to the console) and persisted it as plaintext in
HKCU\Environment via SetEnvironmentVariable, readable by anyone with
console visibility or local registry access. Switched to
Read-Host -AsSecureString and store ConvertFrom-SecureString's DPAPI
output (decryptable only by the same user on the same machine)
instead of the raw value.

Extract-NTHashes.ps1, the only other consumer, now decrypts that
DPAPI-protected string back to a plain string via
ConvertTo-SecureString + NetworkCredential right before handing it to
Protect-FileWithAES. A stale plaintext value from a prior version is
detected and the operator is prompted to re-enter it.

DPAPI protection is Windows-only, consistent with the rest of this
Windows/AD-only tool; not runnable end-to-end on this (non-Windows)
dev machine, verified by AST parse only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 Elysium.ps1          | 27 ++++++++++++++++++---------
 Extract-NTHashes.ps1 | 12 +++++++++---
 2 files changed, 27 insertions(+), 12 deletions(-)

diff --git a/Elysium.ps1 b/Elysium.ps1
index 7c5e2f8..428ab0e 100644
--- a/Elysium.ps1
+++ b/Elysium.ps1
@@ -39,17 +39,26 @@ if (-Not (Test-Path $settingsFilePath)) {
     Write-Host "ElysiumSettings.txt found."
 }
 
-# Attempt to retrieve the passphrase from the environment variable
-$passphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
+# The passphrase is persisted DPAPI-protected (current user + machine) via ConvertFrom-SecureString,
+# never in plaintext, so it's only prompted for once per user/machine and never echoed to the console.
+$storedPassphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
 
-if ([string]::IsNullOrEmpty($passphrase)) {
+$havePassphrase = $false
+if (-not [string]::IsNullOrEmpty($storedPassphrase)) {
+    try {
+        [void](ConvertTo-SecureString -String $storedPassphrase -ErrorAction Stop)
+        $havePassphrase = $true
+        Write-Host "Passphrase found in environment variables."
+    } catch {
+        Write-Warning "Stored passphrase is not in the expected protected format (leftover from an older Elysium version?). Re-enter it."
+    }
+}
+
+if (-not $havePassphrase) {
     Write-Host "No passphrase found in environment variables."
-    $passphrase = Read-Host "Please enter your passphrase."
-    # Here you could choose to set the environment variable or simply use the passphrase for the current session
-    [System.Environment]::SetEnvironmentVariable("ELYSIUM_PASSPHRASE", $passphrase, [System.EnvironmentVariableTarget]::User)
-    Write-Host "Passphrase stored as environment variable 'ELYSIUM_PASSPHRASE'."
-} else {
-    Write-Host "Passphrase found in environment variables."
+    $securePassphrase = Read-Host "Please enter your passphrase" -AsSecureString
+    [System.Environment]::SetEnvironmentVariable("ELYSIUM_PASSPHRASE", (ConvertFrom-SecureString -SecureString $securePassphrase), [System.EnvironmentVariableTarget]::User)
+    Write-Host "Passphrase stored (DPAPI-protected) as environment variable 'ELYSIUM_PASSPHRASE'."
 }
 
 function Start-OrchestratorTranscript {
diff --git a/Extract-NTHashes.ps1 b/Extract-NTHashes.ps1
index 2c150a0..0c24c93 100644
--- a/Extract-NTHashes.ps1
+++ b/Extract-NTHashes.ps1
@@ -190,9 +190,15 @@ try {
     try { $s3ForcePathStyle = [System.Convert]::ToBoolean($s3ForcePathStyle) } catch { $s3ForcePathStyle = $true }
     try { $s3UseAwsTools = [System.Convert]::ToBoolean($s3UseAwsTools) } catch { $s3UseAwsTools = $false }
 
-    # Retrieve the passphrase from a user environment variable
-    $passphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
-    if ([string]::IsNullOrWhiteSpace($passphrase)) { throw 'Passphrase not found in ELYSIUM_PASSPHRASE environment variable.' }
+    # Retrieve the DPAPI-protected passphrase from a user environment variable (see Elysium.ps1)
+    $protectedPassphrase = [System.Environment]::GetEnvironmentVariable("ELYSIUM_PASSPHRASE", [System.EnvironmentVariableTarget]::User)
+    if ([string]::IsNullOrWhiteSpace($protectedPassphrase)) { throw 'Passphrase not found in ELYSIUM_PASSPHRASE environment variable. Run Elysium.ps1 once to set it.' }
+    try {
+        $securePassphrase = ConvertTo-SecureString -String $protectedPassphrase -ErrorAction Stop
+    } catch {
+        throw "ELYSIUM_PASSPHRASE is not in the expected DPAPI-protected format (leftover from an older Elysium version?). Re-run Elysium.ps1 to re-enter it."
+    }
+    $passphrase = [System.Net.NetworkCredential]::new('', $securePassphrase).Password
 
     $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"