{"id":227788,"date":"2024-03-14T16:34:37","date_gmt":"2024-03-14T15:34:37","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=227788"},"modified":"2026-04-22T08:27:31","modified_gmt":"2026-04-22T08:27:31","slug":"ivanti-auto-aes-keys-recovery","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/ivanti-auto-aes-keys-recovery\/","title":{"rendered":"Addressing Forensic Challenges in Ivanti Pulse Secure Environments with Automated AES Key Recovery"},"content":{"rendered":"

[et_pb_section fb_built= \u00bb1\u2033 _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_row _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_column type= \u00bb4_4\u2033 _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_text _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb hover_enabled= \u00bb0\u2033 global_colors_info= \u00bb{} \u00bb sticky_enabled= \u00bb0\u2033]<\/p>\n

On January 10, 2024, Ivanti issued a warning regarding two high-severity zero-day vulnerabilities (CVE-2023-46805<\/strong> and CVE-2024-218871<\/strong>) in Ivanti Connect Secure VPN. These vulnerabilities allow for authentication bypass and command injection within the web components of Ivanti Connect Secure and Ivanti Policy Secure. Threat actors can exploit these vulnerabilities to gain unauthorized access to restricted resources by evading control checks. Furthermore, authenticated administrators have the ability to send specially crafted requests and execute arbitrary commands on the affected appliance.<\/p>\n

However, conducting forensic analyzes becomes challenging because Ivanti uses a custom version of its kernel based on LILO (Linux loader) that integrates the loop-AES tool for encrypting its data partitions.<\/p>\n

Ivanti Connect Secure, formerly known as Pulse Connect Secure, uses loop-AES encryption to secure its data partitions. Three different AES keys can be found in the three different kernels associated with the current, rollback, and resets factory partitions. While this encryption mechanism enhances data security, it presents significant hurdles for forensic analysts attempting to conduct digital investigations. With attackers actively exploiting vulnerabilities in Ivanti Connect Secure, it becomes imperative for analysts to overcome these encryption barriers to effectively analyze incidents and mitigate threats.<\/p>\n

Thanks to the publication and work carried out by NorthwaveSecurity, we have been able to create a tool that automatically attempts to recover the AES encryption keys contained in Ivanti Pulse Connect Secure kernels (using LILO BootLoader and loop-AES).<\/p>\n

The tool operates on dumped and decompressed (with extract-vmlinux<\/a>) Linux kernels extracted from unencrypted partitions. Leveraging memory signature patterns, it identifies the loop_setup_root function within the kernel. Upon successful detection, the tool retrieves XORed AES encryption keys and their corresponding XOR keys. It then applies XOR operations to recover the AES keys, presenting them in a format compatible with the \u00ablilo-pulse-secure-decrypt tool\/dsdecrypt\u00bb (made by NorthwaveSecurity), which can decrypt DATA partitions.<\/p>\n

[\/et_pb_text][et_pb_text _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb]<\/p>\n

Below, an example of encrypted Ivanti Connect Secure volume. As expected, file & xxd commands display \u00abdata\u00bb.<\/p>\n

[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2024\/03\/encrypted.png" alt="Encrypted Volume" title_text="encrypted_volume" align="center" _builder_version="4.24.2" _module_preset="default" global_colors_info="{}"][\/et_pb_image][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2024\/03\/encrypted2.png" alt="Encrypted Volume" title_text="encrypted_volume" align="center" _builder_version="4.24.2" _module_preset="default" global_colors_info="{}"][\/et_pb_image][et_pb_text _builder_version="4.24.2" _module_preset="default" custom_padding="||0px|||" global_colors_info="{}"]<\/p>\n

If the tool runs successfully and manages to find the signature of the \u00ab\u00a0loop_setup_root<\/strong>\u00a0\u00bb function, you should get output similar to the screenshot below.<\/p>\n

[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2024\/03\/out.png" alt="Tool Execution Example" title_text="Tool Execution Example" align="center" _builder_version="4.24.2" _module_preset="default" global_colors_info="{}"][\/et_pb_image][et_pb_text _builder_version="4.24.2" _module_preset="default" global_colors_info="{}"]<\/p>\n

Once AES key recovered, we can compile dsdecrypt<\/strong> in order to decrypt our volume.<\/p>\n

[\/et_pb_text][et_pb_image src="https:\/\/www.intrinsec.com\/wp-content\/uploads\/2024\/03\/decrypted-1.png" alt="Decrypted Volume" title_text="Decrypted Volume" align="center" _builder_version="4.24.2" _module_preset="default" global_colors_info="{}"][\/et_pb_image][et_pb_text _builder_version="4.24.2" _module_preset="default" global_colors_info="{}"]<\/p>\n

To find out more about reverse engineering of the AES encryption part of the Ivanti Kernel based on LILO \/ loop-AES, we invite you to consult the excellent article published by NorthWave-Cyber Security. You can find the link below in the external resources section.<\/p>\n

[\/et_pb_text][et_pb_text _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb]<\/p>\n

You can download our tool on our GitHub repository at https:\/\/github.com\/Intrinsec\/ivanti_lilo_extract_aes_key<\/a><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_column type= \u00bb4_4\u2033 _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb][et_pb_text _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb]<\/p>\n

External Resources<\/h3>\n

[\/et_pb_text][et_pb_text _builder_version= \u00bb4.24.2\u2033 _module_preset= \u00bbdefault \u00bb global_colors_info= \u00bb{} \u00bb]<\/p>\n