linux-lateral-movement
This skill teaches advanced techniques for moving between Linux hosts after initial compromise. Master SSH agent hijacking, private key discovery, credential extraction from system files and process memory, D-Bus service abuse, and internal network tunneling to expand your foothold across infrastructure.
Linux Lateral Movement teaches SSH hijacking, credential harvesting, and network pivoting to move across compromised Linux hosts.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/linux-lateral-movement · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/linux-lateral-movement ~/.claude/skills/linux-lateral-movementnpx skillfed install yaklang/hack-skills/linux-lateral-movementFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are the main linux lateral movement techniques?
linux-lateral-movement covers SSH agent hijacking, private key harvesting from user home directories and process memory, credential extraction from system files, and abuse of D-Bus services. After initial compromise, these techniques enable attackers to move between hosts using stolen credentials, hijacked SSH agents, and service exploitation to expand control across the infrastructure.
How does SSH agent hijacking work in linux-lateral-movement?
linux-lateral-movement teaches SSH agent hijacking by locating the SSH_AUTH_SOCK environment variable pointing to the agent socket, then connecting to it to reuse the victim's loaded private keys. This allows lateral movement to systems the compromised user can access without needing to steal or crack the actual key files.
What methods does linux-lateral-movement teach for SSH key harvesting?
linux-lateral-movement covers multiple SSH key harvesting methods: scanning ~/.ssh directories for private keys, extracting keys from process memory using ptrace, harvesting credentials from shell history and config files, and exploiting world-readable key permissions. These techniques enable attackers to collect authentication material for multi-host compromise.
How can I pivot across linux servers using SSH tunneling?
linux-lateral-movement teaches internal network pivoting through multi-hop SSH tunneling, where compromised hosts become jump servers to reach deeper network segments. Attackers establish local port forwarding and SOCKS proxies through intermediate hosts, combined with network reconnaissance to map internal topology and identify additional targets.
What D-Bus and systemd exploitation techniques does linux-lateral-movement cover?
linux-lateral-movement covers D-Bus service abuse for privilege escalation and lateral access, including polkit exploitation and sudo token reuse attacks. It also teaches systemd service backdooring to establish persistent access and create tunnels for continued lateral movement across the compromised infrastructure.
How does linux-lateral-movement address credential harvesting from Linux hosts?
linux-lateral-movement teaches harvesting credentials from multiple sources: extracting SSH keys from ~/.ssh and system directories, recovering passwords from process memory and shell history, exploiting shared filesystems with no_root_squash, and abusing sudo tokens. These harvested credentials enable reuse across multiple hosts for infrastructure-wide compromise.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Linux Lateral Movement — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.
0. RELATED ROUTING
Before going deep, consider loading:
- linux-privilege-escalation if you need root on the current host before pivoting
- linux-security-bypass when restricted shells or security modules block lateral movement tools
- container-escape-techniques when the target network includes containerized hosts
-
kubernetes-pentesting when pivoting into a Kubernetes cluster
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/linux-lateral-movement/SKILL.md