linux-lateral-movement

A Linux lateral-movement playbook for pivoting across hosts once initial access is established, focused on reusing credentials and trust relationships rather than exploiting single-host vulnerabilities. A signature technique is SSH agent hijacking: locating other users' agent sockets under /tmp or via /proc environ, exporting SSH_AUTH_SOCK, listing keys with ssh-add -l, and authenticating onward using the victim's forwarded agent, including persistent monitoring for new sockets as admins log in.

Credential-centric coverage continues with SSH key harvesting: finding private keys, testing which lack passphrases, parsing known_hosts (including hashed entries) to enumerate reachable hosts, and injecting attacker public keys into authorized_keys, alongside a broad table of credential locations spanning /etc/shadow, shell and database histories, .pgpass, .my.cnf, .netrc, .git-credentials, environment variables, app config files, and secret stores. It also covers D-Bus exploitation to enumerate and abuse systemd and PolicyKit, internal network pivoting (SSH local/remote/dynamic forwards, multi-hop ProxyJump, socat, ncat, the /dev/tcp bash builtin, and chisel), network discovery from the foothold, and shared-filesystem abuse via NFS mounts.

Use it after landing on a Linux host when the goal is to reach adjacent systems and expand access across the network. The techniques emphasize approaches that are quiet and rely on existing material: hijacking a live agent, reusing harvested keys and passwords, and scanning subnets with only bash builtins when no tools are available. The skill routes to companion playbooks for local privilege escalation (to get root before pivoting), security-module bypass, container escape, Kubernetes pentesting, and exploitation of discovered internal services such as Redis and MongoDB.