linux-lateral-movement
This skill teaches advanced techniques for moving between Linux hosts after initial compromise. Master SSH agent hijacking, private key discovery, credential extraction from system files and process memory, D-Bus service abuse, and internal network tunneling to expand your foothold across infrastructure.
Linux Lateral Movement teaches SSH hijacking, credential harvesting, and network pivoting to move across compromised Linux hosts.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Linux Lateral Movement teaches SSH hijacking, credential harvesting, and network pivoting to move across compromised Linux hosts. This skill teaches advanced techniques for moving between Linux hosts after initial compromise. Master SSH agent hijacking, private key discovery, credential extraction from system files and process memory, D-Bus service abuse, and internal network tunneling to expand your foothold across infrastructure.
Use it when
- linux-lateral-movement teaches SSH agent hijacking by locating the SSH_AUTH_SOCK environment variable pointing to the agent socket.
- linux-lateral-movement covers multiple SSH key harvesting methods: scanning ~/.ssh directories for private keys.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/linux-lateral-movement · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are the main linux lateral movement techniques?
linux-lateral-movement covers SSH agent hijacking, private key harvesting from user home directories and process memory, credential extraction from system files, and abuse of D-Bus services. After initial compromise, these techniques enable attackers to move between hosts using stolen credentials, hijacked SSH agents, and service exploitation to expand control across the infrastructure.
How does SSH agent hijacking work in linux-lateral-movement?
linux-lateral-movement teaches SSH agent hijacking by locating the SSH_AUTH_SOCK environment variable pointing to the agent socket, then connecting to it to reuse the victim's loaded private keys. This allows lateral movement to systems the compromised user can access without needing to steal or crack the actual key files.
What methods does linux-lateral-movement teach for SSH key harvesting?
linux-lateral-movement covers multiple SSH key harvesting methods: scanning ~/.ssh directories for private keys, extracting keys from process memory using ptrace, harvesting credentials from shell history and config files, and exploiting world-readable key permissions. These techniques enable attackers to collect authentication material for multi-host compromise.
How can I pivot across linux servers using SSH tunneling?
linux-lateral-movement teaches internal network pivoting through multi-hop SSH tunneling, where compromised hosts become jump servers to reach deeper network segments. Attackers establish local port forwarding and SOCKS proxies through intermediate hosts, combined with network reconnaissance to map internal topology and identify additional targets.
What D-Bus and systemd exploitation techniques does linux-lateral-movement cover?
linux-lateral-movement covers D-Bus service abuse for privilege escalation and lateral access, including polkit exploitation and sudo token reuse attacks. It also teaches systemd service backdooring to establish persistent access and create tunnels for continued lateral movement across the compromised infrastructure.
How does linux-lateral-movement address credential harvesting from Linux hosts?
linux-lateral-movement teaches harvesting credentials from multiple sources: extracting SSH keys from ~/.ssh and system directories, recovering passwords from process memory and shell history, exploiting shared filesystems with no_root_squash, and abusing sudo tokens. These harvested credentials enable reuse across multiple hosts for infrastructure-wide compromise.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Linux Lateral Movement — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.
0. RELATED ROUTING
Before going deep, consider loading:
- linux-privilege-escalation if you need root on the current host before pivoting
- linux-security-bypass when restricted shells or security modules block lateral movement tools
- container-escape-techniques when the target network includes containerized hosts
-
kubernetes-pentesting when pivoting into a Kubernetes cluster
(truncated - see the full file via the links below)
File tree — 1 file
skills/linux-lateral-movement/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Move laterally across compromised Linux infrastructure using SSH and credential exploitation”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill teaches penetration testers to identify and exploit scheduled tasks, system services, and inter-process communication mechanisms for privilege escalation. It covers writable cron scripts, PATH manipulation, wildcard injection attacks, systemd unit modification, and D-Bus service exploitation—all under explicit authorization.
Systematically identify and exploit sudo weaknesses, SUID/SGID binaries, and Linux capability misconfigurations to gain root access. The skill covers GTFOBins-based escapes, environment variable injection, CVE exploitation, and polkit vulnerabilities across multiple attack vectors.
Pinggy Tunnel creates instant public URLs for local services using SSH reverse tunnels, with no daemon installation needed. Free tier offers 60-minute tunnels with random subdomains; Pro tier ($3/mo) adds persistent URLs and longer session times. Supports HTTP, HTTPS, TCP, and TLS tunneling with optional access controls like basic auth, bearer tokens, IP whitelisting, and CORS.
Master network tunneling and pivoting techniques to access internal systems from compromised hosts. This skill covers SSH port forwarding, reverse SOCKS proxies via Chisel, transparent TUN-based pivoting with Ligolo-ng, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting methods, and multi-layer chaining strategies.
Linux Discovery helps penetration testers systematically identify privilege escalation opportunities on Linux hosts through enumeration of system configuration, sudo settings, group memberships, and kernel vulnerabilities. The skill gathers baseline system information, analyzes user context and permissions, and maps exploitable vectors while respecting scope boundaries and engagement logging.
This skill guides you through pivoting and tunneling strategies to reach internal networks from a compromised host during authorized penetration tests. It covers SSH port forwarding, SOCKS proxies, and specialized tools like Chisel, Ligolo-ng, and sshuttle, with a decision tree to select the right approach based on available access and network constraints.
More skills linux-privilege-escalation (MIT) · Server Security Init Skill (NOASSERTION) · Macos Security Privacy Hardening (NOASSERTION)