openssh unix dev - May 2014 - Memory Forensics of OpenSSH

Hello List, 

One of my project needs memory forensics of OpenSSH. Here is a brief description
of the problem:

I have a raw memory dump, and all of the kernel data structures (e.g.,
task_struct, mm_struct) have been figured out. Now, I want to retrieve the data
structures (e.g., struct session_state) of an SSH process instance. Finding a
session key (active_state->newkeys) could be an example.  In order to find
these information, I think I need a starting point (i.e., memory address) of the
OpenSSH data structures.

Does anyone know how to tackle this problem? Any comments and suggestions are
much appreciated.

Thanks,
Fengwei

Although I cannot speak with any authority on the data structures of SSH, I
can at least point you in the right direction on tools already available.

Looks like someone also wrote a tool already to do SSH key extraction from
memory;
https://github.com/kholia/passe-partout

Have a look at volatility framework;
https://code.google.com/p/volatility/wiki/VolatilityIntroduction?tm=6
http://www.forensicswiki.org/wiki/Volatility_Framework
http://www.forensicswiki.org/wiki/List_of_Volatility_Plugins

Also these;
http://sneakygcr.tumblr.com/post/52514790216/how-to-extract-the-private-key-from-a-running-ssh
http://c0decstuff.blogspot.co.uk/2011/01/in-memory-extraction-of-ssl-private.html
http://www.vnsecurity.net/2009/10/how-to-recover-rsa-private-key-in-a-coredump-of-ssh-agent-sapheads-hackjam-2009-challenge-6/

Hope this helps

Cal



On Sun, May 4, 2014 at 9:37 PM, Fengwei Zhang <namedylan at gmail.com>
wrote:
> Hello List,
>
> One of my project needs memory forensics of OpenSSH. Here is a brief
> description of the problem:
>
> I have a raw memory dump, and all of the kernel data structures (e.g.,
> task_struct, mm_struct) have been figured out. Now, I want to retrieve the
> data structures (e.g., struct session_state) of an SSH process instance.
> Finding a session key (active_state->newkeys) could be an example.  In
> order to find these information, I think I need a starting point (i.e.,
> memory address) of the OpenSSH data structures.
>
> Does anyone know how to tackle this problem? Any comments and suggestions
> are much appreciated.
>
> Thanks,
> Fengwei
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>