PowerShell: Impersonation to Download Files Through Proxy

Initial Script to without impersonation

# Change these values to reflect your desired downloads
[string]$fileSource = "https://blog.kimconnect.com/wp-content/uploads/2019/05/PortQry.zip";
$fileName="portqry.exe"
[string]$saveAs = "C:\Temp\$fileName";
$destination="C:\WINDOWS\System32\SysInternals\";
    
$fileExists=Test-Path $destination$fileName -PathType Leaf
"File exists: $fileExists"
    
if (!($fileExists)){
    # Create temp folder to hold the downloads
    New-Item -ItemType Directory -Force -Path C:\Temp | Out-Null

    # Download
    $source = "https://blog.kimconnect.com/wp-content/uploads/2019/05/PortQry.zip";
    $destination = "C:\Temp\PortQry.zip";
    $download = (New-Object System.Net.WebClient).DownloadFile($source,$destination)

    # Extract
    $log="C:\Temp\kbLog.txt"
    $extractFolder="C:\temp\PortQry\"
    New-Item -ItemType Directory -Force -Path $extractFolder | Out-Null
    expand-archive $destination $extractFolder

    # Put the excutable in its expected directory
    New-Item -ItemType Directory -Force -Path C:\WINDOWS\System32\SysInternals | Out-Null
    cp C:\PortQryV2\PortQry.exe C:\WINDOWS\System32\SysInternals\
}else{"portqry.exe already exists at $saveAs.";}

Errors:

# This occurs when authentication is incorrect
Exception calling "DownloadFile" with "2" argument(s): "The remote server returned an error: (407) Proxy
Authentication Required."
At line:1 char:1
+ $WebClient.DownloadFile($source,$dest);
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException

# This happens if authentication SSL protocols do not match between proxy and PowerShell client
Exception calling "DownloadFile" with "2" argument(s): "The underlying connection was closed: An unexpected error
occurred on a receive."
At line:1 char:1
+ (new-object System.Net.WebClient).DownloadFile($url,$temp)
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : WebException

Resolution:

# Add this line to the script to set TLS1.2 as default on PowerShell user-agent
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Corrected Script:

$source = "https://blog.kimconnect.com/wp-content/uploads/2019/05/IISCryptoCli.zip";
$dest = "C:\Temp\IISCryptoCli.zip";
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$WebClient = New-Object System.Net.WebClient;
$WebProxy = New-Object System.Net.WebProxy("http://proxy:80",$true);
$Credentials = (New-Object Net.NetworkCredential("KIMCONNECT","PASSWORD","kimconnect.com")).GetCredential("http://proxy","80", "KERBEROS");
#$Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
$WebProxy.Credentials = $Credentials;
$WebClient.Proxy = $WebProxy;
$WebClient.DownloadFile($source,$dest);

Alternative Methods:

New-Item -ItemType Directory -Force -Path C:\Temp # Create Temp folder if it doesn't already exist

$proxy="http://proxy:80";
$exclusionList="localhost;*.domain.local"

# Set winhttp proxy for PowerShell
netsh winhttp set proxy $proxy $exclusionList

# Prepare PowerShell to Use Default Credentials & TLS
[system.net.webrequest]::defaultwebproxy = New-Object system.net.webproxy($proxy)
[system.net.webrequest]::defaultwebproxy.credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
[system.net.webrequest]::defaultwebproxy.BypassProxyOnLocal = $true
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# Download using the most efficient method
$url = "https://blog.kimconnect.com/wp-content/uploads/2019/05/IISCryptoCli.zip"    
$temp = "C:\Temp\IISCryptoCli.zip"
Import-Module BitsTransfer
Start-BitsTransfer -Source $url -Destination $temp

$source = "https://www.7-zip.org/a/7z1900-x64.msi";
$dest = "C:\Temp\7z1900-x64.msi";
$browser = New-Object System.Net.WebClient
$browser.Proxy.Credentials =[System.Net.CredentialCache]::DefaultNetworkCredentials;
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$browser.DownloadFile($source,$dest);

$source = "https://www.7-zip.org/a/7z1900-x64.msi";
$dest = "C:\Temp\7z1900-x64.msi";
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
(new-object System.Net.WebClient).DownloadFile($source,$dest)

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
[Net.WebRequest]::DefaultWebProxy.Credentials = [Net.CredentialCache]::DefaultCredentials; iex ((New-Object Net.WebClient).DownloadString('https://blog.kimconnect.com/wp-content/uploads/2019/05/IISCryptoCli.zip'))

$page = (new-object net.webclient)
$page.UseDefaultCredentials = $True
$Page.DownloadString('https://blog.kimconnect.com/wp-content/uploads/2019/05/IISCryptoCli.zip')