Dumping Wi-Fi Passwords

by Jul 23, 2020

In the previous tip we used netsh.exe to dump Wi-Fi profiles. Let’s take it a step further and expose the cached passwords:

 # get cleartext password for each profile
 Foreach ($profile in $profiles)
       $password = (@(netsh wlan show profile name="$profile" key=clear) -like '*Key Content*' -split ': ')[-1]
             Profile = $profile
             Password = $password

This is just an example how string information returned by console applications such as netsh.exe can be processed by PowerShell. There are chances you run into challenges, too: when Wi-Fi profile names use special characters such as apostrophes, they may not be retrievable via netsh.exe.

Twitter This Tip! ReTweet this Tip!