netspi/sshkey-grab

Grab ssh keys from ssh-agent

sshkey-grab

This script uses a bug in ssh-agent that allows it to pull the last key added to the agent. This may allow the ability to recover a key that has been removed from ssh-agent via ssh-add -t, -d, or -D, provided that the ssh-agent was not terminated and a new key has not been added since the previous one was removed. This bug has been reported and may be fixed in newer versions of OpenSSH, which will cause this tool to break.

Requirements

• grabagentmem.sh requries root access and gdb on the target machine to work properly
• parse_mem.py requires the pyasn1 python module to be installed

Usage

1. Copy grabagentmem.sh to the target machine.
2. Run grabagentmem.sh on the target machine as root. This will create a memory dump of the stack for each ssh-agent process running on this box. They will be named /tmp/SSHagent-$PID.stack by default.
3. Copy the stack traces to the machine that has parse_mem.py installed
4. run parse_mem.py [stack file] [key output] (Example: ./parse_mem.py /tmp/SSHagent-17019.stack /tmp/key)
5. Test to see if extracted key file works by using ssh -i [key file] [user]@[machine]

Part of the RSA key creation code is from Thialfihar's Fancy SSH Key Generator: https://github.com/thialfihar/semantic-ssh-key/blob/master/generate_fancy_ssh_key.py

sshkey-grab's Issues

Can the parse_mem.py script extract an RSA key from a core dump file from an ssh agent?

trying to run the parse_mem.py file and getting these errors trying to see if the script will do what I think it can the question which is the title of this issue. here is the error output

python3 parse_mem.py
/home/john/Desktop/t5/sshkey-grab/parse_mem.py:45: SyntaxWarning: "is not" with a literal. Did you mean "!="?
if magic is not -1:
/home/john/Desktop/t5/sshkey-grab/parse_mem.py:91: SyntaxWarning: "is" with a literal. Did you mean "=="?
if self.type is "rsa":
/home/john/Desktop/t5/sshkey-grab/parse_mem.py:94: SyntaxWarning: "is" with a literal. Did you mean "=="?
elif self.type is "dsa":
Traceback (most recent call last):
File "/home/john/Desktop/t5/sshkey-grab/parse_mem.py", line 185, in
keystart.read(sys.argv[1])
IndexError: list index out of range

┌──(john㉿kali)-[~/Desktop/t5/sshkey-grab]
└─$ python3 parse_mem.py core
/home/john/Desktop/t5/sshkey-grab/parse_mem.py:45: SyntaxWarning: "is not" with a literal. Did you mean "!="?
if magic is not -1:
/home/john/Desktop/t5/sshkey-grab/parse_mem.py:91: SyntaxWarning: "is" with a literal. Did you mean "=="?
if self.type is "rsa":
/home/john/Desktop/t5/sshkey-grab/parse_mem.py:94: SyntaxWarning: "is" with a literal. Did you mean "=="?
elif self.type is "dsa":
Traceback (most recent call last):
File "/home/john/Desktop/t5/sshkey-grab/parse_mem.py", line 185, in
keystart.read(sys.argv[1])
File "/home/john/Desktop/t5/sshkey-grab/parse_mem.py", line 24, in read
self.mem = "".join(file.readlines())
TypeError: sequence item 0: expected str instance, bytes found

thank you in advance if you can help with getting this script working

It doesn't work.

I attempted to extract my key from my running ssh-agent process. However, upon attempting to use the key:

ssh_rsa_sign: RSA_sign failed: error:0306B067:bignum routines:BN_div:div by zero

Wondering how create_rsa worked

Hi!

I accidentally deleted my ssh keys, and I figured I could try to recover them from my ssh-agent. I came across your script, and the output public key I get from a generated private key does not match the one I have on file on services like github.

I know anything along the line could have failed, but the code right under the comment # FIXME: This needs to be cleaned up. in the python file seems the most obscure to me. How did you determine the offsets?

Other maybe useful info:
My size variable reading memory after "ssh-rsa" from bytes 10-12 is currently 769.

• n size: 769
• e size: 0
• d size: 0
• c size: 0
• p size: 0
• q size: 0
  I also noticed that the private key n slot contains the correct n+e data as I can verify that from my public key. Hmmmm
  Also, I'm actually on a mac, so I've been using vmmap and lldb instead of /proc/ and gdb.