These scripts are a PoC for how to extract unencrypted private SSH keys from Windows when the new OpenSSH ssh-agent.exe is used.
When adding private keys to ssh-agent, Windows protects the private keys with DPAPI and stores them as registry entries under HKCU:\Software\OpenSSH\Agent\Keys
With elevated privileges, it is possible to pull out the binary blobs from the registry and unprotect them using DPAPI. These blobs can then be restructured into the original, unencrypted private RSA keys.
All credit for the Python code should go to the original implementation by soleblaze and his script parse-mem.pyhere
From an elevated Powershell prompt, use extract_ssh_keys.ps1 to generate a JSON file which contains the Base64 data of the unprotected SSH keys. This script works by enumerating all SSH keys stored in the registry and calling DPAPI with the “Current User” context to unprotect the binary data.
C:\tools> .\extract_ssh_keys.ps1
Pulling key: .\ropnopkey2
Pulling key: .\ropnopkey1
extracted_keyblobs.json written. Use Python script to reconstruct private keys: python extractPrivateKeys.py extracted_keyblobs.json
The Python script requires Python 3 and the pyasn1 package. Run the Python script on the saved JSON file to reconstruct the original, unencrypted RSA private keys:
