Decrypting OpenSSH sessions for fun and profit

▤ Summary

A while ago we had a forensics case in which a Linux server was compromised and a modified OpenSSH binary was loaded into the memory of a webserver. We started wondering if it was possible to decrypt the SSH session and gain knowledge of it by recovering key material from the memory snapshot. Next up the client will send a KEX_INIT message to the server to start negotiating parameters for the session like key exchange and encryption algorithm. One level deeper we finally find the “sshenc” structure holding the name of the cipher, the key, IV and the block length. I started of building a POC Python script which I could run on a live host which attaches to processes and scrapes the memory for this structure.

▦ Linked Companies

GitHub, Inc.

$1M to $5M