Agent skill · security · yaklang
linux-lateral-movement
Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.
Why this skill is useful
Includes detailed executable scripts for SSH hijacking and credential harvesting that extend the AI's capabilities in penetration testing.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Linux Lateral Movement — Expert Attack Playbook AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSHAUTHSOCK hijacking and ptrace-based sudo session hijack. 0. RELATED ROUTING Before going deep, consider loading: linux-privilege-escalation if you need root on the current host before pivoting linux-security-bypass when restricted shells or security modules block lateral movement tools container-escape-techniques when the target network includes containerized hosts kubernetes-pentesting when pivoting into a Kubernetes cluster unauthorized-access-common-services for exploiting discovered internal services (Redis, MongoDB, etc.) --- 1. SSH AGENT HIJACKING 1.1 Find SSH Agent Sockets 1.2 Hijack Agent Forwarding 1.3 Persistent Agent Monitoring --- 2. SSH KEY HARVESTING 2.1 Private Key Locations 2.2 knownhosts Parsing 2.3 authorizedkeys Injection --- 3. CREDENTIAL HARVESTING LOCATIONS 3.1 System Credentials Location Contents Command --- --- --- /etc/shadow Password hashes cat /etc/shadow (root) /etc/passwd User list, may contain hashes cat /etc/passwd .bashhistory Command history (passwords in cleartext) cat /home//.bashhistory .mysqlhistory MySQL commands with passwords cat /home//.mysqlhistory .psqlhistory PostgreSQL commands cat /home//.psqlhistory .pgpass PostgreSQL password file cat /home//.pgpass .my.cnf MySQL credentials cat /home//.my.cnf .netrc FTP/HTTP auto-login credentials cat /home//.netrc .git-credentials Git HTTPS passwords cat /home//.git-credentials 3.2 Environment & Config Files --- 4. D-BUS EXPLOITATION 4.1 Enumerate D-Bus Services 4.2 Abuse systemd & PolicyKit via D-Bus --- 5. INTERNAL NETWORK PIVOTING 5.1 SSH Tunneling 5.2 Without SSH — Alternative Tunnels 5.3 Network Discovery from Compromised Host --- 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/linux-lateral-movement