title: Cannot pass password to sudo su - username using Powershell + plink.exe combination
body: <h3>Project context</h3>
  
  <p>I'm currently working in a very restrictive work environment. I know about all the good practices involving SSH: keys, ssh-agent, etc., unfortunately for various reasons I wouldn't really want to go into right now I'm forced to worked within the very strict environment provided. </p>
  
  <p>I realize the "quality" of the work environment and if you read further please try to treat this question as a purely technical question and maybe even a technical challenge (basically don't ask about the politics behind the current situation :) ) .</p>
  
  <hr>
  
  <h3>Context:</h3>
  
  <p>A Windows VM with a very limited set of tools available. Limited to no access to the Internet and no approval for installing third-party anythings (extra tools, libraries, etc.).</p>
  
  <p>So, the things I have available are: </p>
  
  <ul>
  <li><strong>Putty</strong> (which includes plink.exe as a command line SSH client)</li>
  <li><strong>Powershell 2.0</strong></li>
  </ul>
  
  <hr>
  
  <p>Using these tools I'd like to automate a very restrictive SSH workflow that looks like this, most of the time:</p>
  
  <ul>
  <li><p><strong>password based-SSH login</strong> using personal account (no SSH keys allowed)</p></li>
  <li><p><strong>only sudo su - application_account</strong> to access the application account (no access to /etc/sudoers, no access to additional sudoers commands, I can only su to the application account)</p></li>
  <li><p><strong>scripts must prompt for password for each execution</strong></p></li>
  </ul>
  
  <p>I got a working automation setup with Python + Fabric + prompt automation that did almost everything I wanted. Unfortunately for various reasons this setup is in a "gray area" and it might be blacklisted.</p>
  
  <p>So now I'm trying to use only the tools available within the VM, currently Powershell + plink.exe. Unfortunately I can't seem to get to the final step of the automation, running sudo su - application_account.</p>
  
  <p>I've tried everything I could think of, almost everything based on using System.Diagnostics.Process to launch plink.exe and then:</p>
  
  <p>Either redirect stdin and send a series of commands, including responding to prompts like this:</p>
  
  <pre><code>$process.StandardInput.WriteLine($password)
  </code></pre>
  
  <p>Or send the password using heredocs:</p>
  
  <p>a)</p>
  
  <pre><code># One-line heredoc.
  echo $password | sudo su - application_account&lt;&lt;&lt; ls
  </code></pre>
  
  <p>b)</p>
  
  <pre><code># Multi-line heredoc.
  echo $password | sudo -S su - &lt;&lt;END
  ls
  END
  </code></pre>
  
  <p>c) or almost any combination involving sudo parameters such as -k, -S, heredoc formats, etc.</p>
  
  <p>Or use the -m parameter of plink.exe to create a file containing the list of commands including a sudo su heredoc execution.</p>
  
  <p>Or trying to use event-based inputs.</p>
  
  <p>...</p>
  
  <p>And many, many others.</p>
  
  <p>I either can't control the process if I redirect all input/output (if I redirect both the process locks and debugging is really hard since I don't have a ton of tools on the VM and I can't see why it's locking).</p>
  
  <p>Or sudo plainly just doesn't accept the password input, as the final deathblow step.</p>
  
  <p>Is it really impossible to control plink.exe in such a restrictive context? I have to note that without access to the application account automation is impossible (i.e. simple personal SSH user automation was achieved long time ago and is not enough).</p>
  
  <p>I'm interested in possible solutions using Powershell or any other tools that come directly with Windows on in advice debugging the setup. Basically how could I see why the process deadlocks. Or any idea, really, that does not involve changing administrative settings anywhere or installing extra tools/apps/libraries.</p>
  
  <p>To add insult to injury, my password contains special characters which the shell doesn't seem to like (I think). Any recommendations for escaping them in Powershell/bash?</p>
  
  <h3>Edit - code I'm using right now:</h3>
  
  <pre><code>$procInfo = New-Object System.Diagnostics.ProcessStartInfo
  $procInfo.RedirectStandardInput = $true
  $procInfo.FileName="C:\Tools\PuTTY\plink.exe"
  $procInfo.Arguments = "-t $sshHost"
  $procInfo.UseShellExecute = $false
  
  $process = New-Object System.Diagnostics.Process
  $process.StartInfo = $procInfo
  [void]$process.Start()
  
  Start-Sleep -m 1000
  $process.StandardInput.WriteLine($sshUser)
  Start-Sleep -m 1000
  $process.StandardInput.WriteLine($password)
  Start-Sleep -m 1000
  $process.StandardInput.WriteLine("sudo su - $applicationUser")
  Start-Sleep -m 5000
  $process.StandardInput.WriteLine($password)
  </code></pre>