Stealing Veracrypt or LUKS hash while system running?

Question

If a hacker gains access to an encrypted system (Veracrypt, LUKS or any other software) via the internet while the system is running - can they steal the hash from RAM and later use that hash to decrypt the system if they gain physical access to it? From what I know a hacker with physical access to a running system can steal the hash, but can this be done without physical access?

Answer 1

If the attacker has root, then yes, easily. For LUKS, this can be done with dmsetup table --showkey /dev/mapper/whatever | awk '{print $5}' | xxd -r -p to get the master key file, which you can then pass to cryptsetup later.