search

fox-it / OpenSSH-Session-Key-Recovery

Project containing several tools/ scripts to recover the OpenSSH session keys used to encrypt/ decrypt SSH traffic.
https://blog.fox-it.com/2020/11/11/decrypting-openssh-sessions-for-fun-and-profit/
Apache License 2.0
81 stars 17 forks source link

The key cannot be found! #3

Open teatreee opened 3 years ago

teatreee commented 3 years ago

[root@localhost volatility-master]# python vol.py -vvvv -f /home/john/volatility-master/0321.vmem --profile=LinuxCentOs7_5x64 linux_sshkeys -n sshd Volatility Foundation Volatility Framework 2.6.1 Failed to import volatility.plugins.registry.shutdown (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.getservicesids (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.timeliner (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.malware.apihooks (NameError: name 'distorm3' is not defined) Failed to import volatility.plugins.malware.servicediff (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.registry.userassist (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.getsids (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.registry.shellbags (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.evtlogs (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.registry.shimcache (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.tcaudit (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.registry.dumpregistry (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.registry.lsadump (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.malware.threads (NameError: name 'distorm3' is not defined) Failed to import volatility.plugins.mac.apihooks_kernel (ImportError: No module named distorm3) Failed to import volatility.plugins.registry.amcache (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.mac.check_syscall_shadow (ImportError: No module named distorm3) Failed to import volatility.plugins.malware.svcscan (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.registry.auditpol (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.ssdt (NameError: name 'distorm3' is not defined) Failed to import volatility.plugins.registry.registryapi (ImportError: No module named Crypto.Hash) Failed to import volatility.plugins.mac.apihooks (ImportError: No module named distorm3) *** Failed to import volatility.plugins.envars (ImportError: No module named Crypto.Hash)

/___/\ \ ()/ OpenSSH Session Key Dumper \ X By Jelle Vergeer \ / \ \/ Scanning for OpenSSH sshenc structures...

Name Pid PPid Address Name Key IV

WARNING : volatility.debug : NoneObject as string: Pointer name invalid WARNING : volatility.debug : NoneObject as string: Pointer name invalid

Always indicates that the pointer is not recognized, System version:centos 7.5

yassirlaaouissi commented 3 years ago

To fix the import errors run one of the following depending on your python version @teatreee 

pip install pycrypto
# or
pip install pycryptodome

Source: https://nomodulenamed.com/m/Crypto.Hash