<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-cryptographic-key-recovery
description: >-
  Recover cryptographic keys from memory dumps, file system artifacts, and
  misconfigured systems during penetration testing and incident response.
  Covers RSA/AES key extraction, DPAPI decryption, keystore cracking,
  and key material recovery techniques.
domain: cybersecurity
subdomain: cryptography
tags:
  - key-recovery
  - memory-forensics
  - dpapi
  - keystore
  - key-extraction
  - rsa
  - aes
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552.004"]
---

# Performing Cryptographic Key Recovery

## Overview

Cryptographic key recovery extracts key material from memory, disk, or
configuration artifacts. This is critical for penetration testing (accessing
encrypted data) and incident response (determining attacker access scope).
Techniques include process memory analysis, keystore cracking, DPAPI
decryption, and file system artifact recovery.

## Prerequisites

| Requirement | Install |
|---|---|
| volatility3 | `pip install volatility3` |
| OpenSSL 3.x | `apt install openssl` |
| john | `apt install john` |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Key File Discovery

```bash
# Search filesystem for cryptographic key files
find / -name '*.pem' -o -name '*.key' -o -name '*.p12' \
  -o -name '*.pfx' -o -name '*.jks' 2>/dev/null

# Check file headers for key material
find /etc /opt /home -name '*.pem' -exec head -1 {} +

# Search for hardcoded keys in source code
grep -rn "BEGIN.*PRIVATE" --include='*.py' --include='*.js' .
```

### Keystore Cracking

```bash
# Crack PKCS#12 password
pfx2john certificate.pfx > pfx_hash.txt
john pfx_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Crack Java keystore
keystore2john keystore.jks > jks_hash.txt
john jks_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Crack SSH private key passphrase
ssh2john id_rsa > ssh_hash.txt
john ssh_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Crack GPG private key passphrase
gpg2john private.gpg > gpg_hash.txt
john gpg_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

### Memory Key Extraction

```bash
# Dump process memory on Linux
gcore -o memdump $(pgrep -f nginx)

# Search for PEM key markers in memory
strings memdump.* | grep -A1 "BEGIN RSA PRIVATE"

# Use volatility3 for Windows memory images
vol -f memory.dmp windows.registry.certificates
```

### Key Validation

```bash
# Verify recovered private key is valid
openssl pkey -in recovered.pem -check -noout

# Extract key information
openssl pkey -in recovered.pem -text -noout

# Test if key matches a certificate
openssl x509 -in cert.pem -noout -modulus | openssl md5
openssl pkey -in key.pem -noout -modulus 2>/dev/null | openssl md5
```

## Common Failures

| Failure | Cause | Fix |
|---|---|---|
| Keys in plaintext on disk | No passphrase protection | Encrypt keys at rest; use HSM |
| Memory not cleared | Key persists in process memory | Secure memory wiping (mlock) |
| Weak keystore password | Dictionary-crackable | Strong passphrase on all keystores |

## Workflow

1. **Identify** — Locate key storage and encrypted artifacts
2. **Extract** — Recover key material from memory/files
3. **Crack** — Attempt passphrase recovery on protected keys
4. **Validate** — Test recovered keys against encrypted data
5. **Report** — Document recovered keys and exposure scope
6. **Remediate** — Rotate compromised keys

## Verification

| Check | Method |
|---|---|
| Keys extracted | Key material recovered from target |
| Passphrase cracked | Protected key files opened |
| Decryption verified | Recovered key decrypts target data |
| Keys rotated | Compromised keys revoked and replaced |

## References

- [Volatility3 Documentation](https://volatility3.readthedocs.io/)
- [John the Ripper — Key Formats](https://www.openwall.com/john/doc/)
- [Microsoft DPAPI](https://learn.microsoft.com/en-us/windows/win32/seccrypto/cng-dpapi)
- [NIST SP 800-57 — Key Management](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
