1

I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python program to return the section of the core dump with the highest entropy (inconclusive). I have access to the ssh-agent binary and the core dump file.

$ file core
core: ELF 64-bit LSB core file, x86-64, version 1 (SYSV), SVR4-style, from 'ssh-agent', real uid: 0, effective uid: 0, real gid: 0, effective gid: 101, execfn: '/usr/bin/ssh-agent', platform: 'x86_64'
$ file ssh-agent
ssh-agent: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=3734cf9330cd22aab10a4b215b8bcf789f0c6aeb, for GNU/Linux 3.2.0, stripped

The version of openssl being used is OpenSSL 1.1.1f 31 Mar 2020 on Ubuntu 20.04

3
  • Just checking: are you sure the key itself is in the dump, rather than just e.g. a file descriptor open to the key file and the passphrase / derived unwrapping key actually resident in memory? If past versions had the entire key in memory you're probably good, but there's no inherent reason it needs to be.
    – CBHacking
    Sep 17, 2022 at 0:42
  • I know the key is in memory I don't know if it is encrypted or not. If so I can crack it after I find a way to extract it. Sep 17, 2022 at 3:59
  • I already tried basic methods like searching for the armored parts I think it is encoded in binary form. Sep 17, 2022 at 4:00

1 Answer 1

3

I wrote an automating tool to do this. Repo: here

Usage: python3 ./ssh-keyfinder.py

It will extract all private keys from core dump. Supports RSA and ECDSA (ed25519).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .