linux-lateral-movement

name	linux-lateral-movement
description	Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.

SKILL: Linux Lateral Movement — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.

0. RELATED ROUTING

Before going deep, consider loading:

• linux-privilege-escalation if you need root on the current host before pivoting
• linux-security-bypass when restricted shells or security modules block lateral movement tools
• container-escape-techniques when the target network includes containerized hosts
• kubernetes-pentesting when pivoting into a Kubernetes cluster
• unauthorized-access-common-services for exploiting discovered internal services (Redis, MongoDB, etc.)

---

1. SSH AGENT HIJACKING

1.1 Find SSH Agent Sockets

# As root (or user with access to other users' processes):
find /tmp -path "*/ssh-*" -name "agent.*" 2>/dev/null
# Or via /proc:
grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | tr '\0' '\n'