Configuring 802.1x PEAP credentials wireless Wi-Fi with PowerShell

Question

I am trying to automate the Wi-Fi connection for testing purposes. Using netsh command in PowerShell I can generate the xml file and connect to any Personal Wi-Fi.

But getting issue with the Enterprise (802.1X). I can generate the xml file with the initial configuration. But username and password are not stored in it. I found that they are stored and encrypted in: HKCU\Software\Microsoft\Wlansvc\UserData\Profiles{GUID} Apparently it is encrypted using CryptProtectData.

I have uploaded the key from one SSID connected with my current user using 802.1X and trying to decrypt it to figure out what is the string that need to be encrypted. Here's the script so far:

Add-Type -AssemblyName System.Security

$HEXA ='01 00 00 00 d0 8c 9d df 01 15 d1 11 8c 7a 00 c0 4f c2 97 eb 01 00 00 
00 a8 55 8d b0 1a c5 48 4e 8e 35 ff...'

##hexa to byte
$HEXA_array= $HEXA.split(" ")
$bytes_object = $HEXA_array | FOREACH {[BYTE][CHAR]
([CONVERT]::toint16($_,16))}

##Create an array of Byte
$i=0
foreach ($element in $bytes_object){$i++}
$Byte_Array = New-Object Byte[] $i

#system.object to system.byte
$i=0
foreach ($element in $bytes_object)
{
$Byte_Array[$i]=$element
$i++
}

write-host "Type of Byte_Array: " $Byte_Array.getType().FullName #

#decrypt
$bytes2 = [System.Security.Cryptography.ProtectedData]::Unprotect(
    $Byte_Array, 
    $null, 
    [System.Security.Cryptography.DataProtectionScope]::CurrentUser)

But I am getting the below error: Exception calling "Unprotect" with "3" argument(s): "The parameter is incorrect"

EDIT: The error is not appearing once I launch the script with the Local System user. I can see the username, but it is followed with unreadable characters. The entropy is set to $null (2nd parameter) and wondering if it could cause the issue

Thank you,

Answer 1

The user/password for WPA-Enterprise is encrypted using two users. I first decrypted the whole string using Local System. Then decrypted again using current user. Entropy is set to $Null in both case. The third parameter will depends on your system OS.

Answer 2

You can find more information on WPA2-Enterprise credentials encryption scheme of MSMUserData in my answer https://superuser.com/a/1259271/780533 to the "How can I find Protected EAP credentials of a wireless network stored on Windows 7?" question. In particular, the "unreadable characters" (note that them begin with 01 00 00 00 d0 8c 9d df ...) following the username in the decrypted MSMUserData are the encrypted password so you need to decrypt again using CryptProtectData.