dfirhub

OpenSSHClient

Appsv1

Author: Matt Dawson

description

OpenSSH Client config, known hosts and keys

paths

9 paths
AppsOpenSSH Config File
C:\Users\%user%\.ssh\config

Config file can hold usernames, IP addresses and ports, key locations and configured shortcuts for servers e.g. ssh web-server

AppsOpenSSH Known Hosts
C:\Users\%user%\.ssh\known_hosts

Known hosts file can hold a list of connected FQDNs/IP Addresses and ports if they are non-default, as well as public key fingerprints

AppsOpenSSH Public Keys
C:\Users\%user%\.ssh\*.pub

Gets all public keys (*.pub). It is more difficult to find private keys as they typically do not have a file extension. However, the .pub files should be able to help find the private keys as they are typically named the same.

AppsOpenSSH Default RSA Private Key
C:\Users\%user%\.ssh\id_rsa

Default name for an auto-generated SSH RSA private key

AppsOpenSSH Default ECDSA Private Key
C:\Users\%user%\.ssh\id_ecdsa

Default name for an auto-generated SSH ECDSA private key

AppsOpenSSH Default ECDSA-SK Private Key
C:\Users\%user%\.ssh\id_ecdsa_sk

Default name for an auto-generated SSH ECDSA private key using a Security Key

AppsOpenSSH Default ED25519 Private Key
C:\Users\%user%\.ssh\id_ed25519

Default name for an auto-generated SSH ED25519 private key

AppsOpenSSH Default ED25519-SK Private Key
C:\Users\%user%\.ssh\id_ed25519_sk

Default name for an auto-generated SSH ED25519 private key using a Security Key

AppsOpenSSH Default DSA Private Key
C:\Users\%user%\.ssh\id_dsa

Default name for an auto-generated SSH DSA private key

› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: OpenSSHClient
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. OpenSSH Config File
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\config" -FolderName "OpenSSH_Config_File"

# 2. OpenSSH Known Hosts
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\known_hosts" -FolderName "OpenSSH_Known_Hosts"

# 3. OpenSSH Public Keys
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\*.pub" -FolderName "OpenSSH_Public_Keys"

# 4. OpenSSH Default RSA Private Key
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\id_rsa" -FolderName "OpenSSH_Default_RSA_Private_Key"

# 5. OpenSSH Default ECDSA Private Key
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\id_ecdsa" -FolderName "OpenSSH_Default_ECDSA_Private_Key"

# 6. OpenSSH Default ECDSA-SK Private Key
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\id_ecdsa_sk" -FolderName "OpenSSH_Default_ECDSA_SK_Private_Key"

# 7. OpenSSH Default ED25519 Private Key
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\id_ed25519" -FolderName "OpenSSH_Default_ED25519_Private_Key"

# 8. OpenSSH Default ED25519-SK Private Key
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\id_ed25519_sk" -FolderName "OpenSSH_Default_ED25519_SK_Private_Key"

# 9. OpenSSH Default DSA Private Key
$UserPath = Join-Path $env:USERPROFILE ".ssh\"
Collect-Artifact -SourcePath "$UserPath\id_dsa" -FolderName "OpenSSH_Default_DSA_Private_Key"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1