OK I think I found the way. For all the time I spent trying to figure it out, it's embarrasingly simple, but I took longer because I did not understand that:
it needs powershell 7 (or maybe 6+, but I didn't test that)
it needs to NOT run in ISE. Running in ISE screws up the type used for the file in the final hash table, even if you try to run PS 7 with enter-pssession. You've been warned! :-)
Anyway, this sample code worked for me - hope it helps someone else:
$Timeout = 15
$restorearea='aliases'
$conffile='c:\path\aliasestest.xml'
$CsrfToken = $null;
$PW = 'pfsense'
$Uri = 'https://192.168.1.1'
$LoginPage = Invoke-WebRequest -TimeoutSec $Timeout -Uri $Uri -SessionVariable Session
$CsrfToken = $LoginPage.InputFields.FindByName('__csrf_magic').Value
$Credential = New-Object System.Management.Automation.PSCredential -ArgumentList 'admin', (ConvertTo-SecureString -AsPlainText -Force ($PW))
$Creds = @{
__csrf_magic=$CsrfToken;
usernamefld=$Credential.GetNetworkCredential().UserName;
passwordfld=$Credential.GetNetworkCredential().Password;
login='Login'
}
# Login to web portal
$Result = Invoke-WebRequest -TimeoutSec $Timeout -WebSession $Session -Uri $uri -Method Post -Body $Creds
$CsrfToken = $Result.InputFields.FindByName('__csrf_magic').Value
# Get backup pagethat
$Result = Invoke-WebRequest -TimeoutSec $Timeout -WebSession $Session -Uri "$uri/diag_backup.php"
$CsrfToken = $Result.InputFields.FindByName('__csrf_magic').Value
$RestoreArguments = @{
__csrf_magic=$CsrfToken
donotbackuprrd='yes'
encrypt_password=''
conffile=get-item -path $conffile
decrypt_password=''
restorearea=$RestoreArea
backuparea=''
restore='Restore Configuration'
}
$Result = Invoke-WebRequest -TimeoutSec $Timeout -WebSession $Session -Uri "$uri/diag_backup.php" -Method 'POST' -form $RestoreArguments
