Linux Lateral Movement
Once you've got a foothold on a Linux box, this is your playbook for moving sideways through the network. It covers the practical stuff: hijacking SSH agents through socket manipulation, harvesting keys and credentials from common locations like bash_history and application configs, abusing D-Bus and systemd for privilege escalation across hosts, and setting up tunnels when you need to pivot deeper. The SSH agent hijacking section is especially solid, showing you how to monitor for forwarded agents and use them without the owner noticing. Also includes techniques for NFS exploitation and sudo token reuse that base models typically miss. It's comprehensive without being theoretical, assumes you already have initial access somewhere, and focuses on the next steps.
- skills.sh installs
- 3.8K
- GitHub stars
- 2.6K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yaklang/hack-skills --skill linux-lateral-movement --agent claude-codeInstalls into .claude/skills of the current project.
Files
SKILL: Linux Lateral Movement — Expert Attack Playbook
AI LOAD INSTRUCTION: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.
0. RELATED ROUTING
Before going deep, consider loading:
- linux-privilege-escalation if you need root on the current host before pivoting
- linux-security-bypass when restricted shells or security modules block lateral movement tools
- container-escape-techniques when the target network includes containerized hosts
- kubernetes-pentesting when pivoting into a Kubernetes cluster
- unauthorized-access-common-services for exploiting discovered internal services (Redis, MongoDB, etc.)
1. SSH AGENT HIJACKING
1.1 Find SSH Agent Sockets
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yaklang/hack-skills
- First seen
- Jun 3, 2026
More from yaklang/hack-skills
All 102- Container Escape Techniques3.8K
- Classical Cipher Analysis3.7K
- Linux Security Bypass3.7K
- Tunneling And Pivoting3.7K
- Prototype Pollution Advanced3.7K
- Steganography Techniques3.7K
- Smart Contract Vulnerabilities3.7K
- Stack Overflow And Rop3.7K
- Rsa Attack Techniques3.7K
- Sandbox Escape Techniques3.7K
- Lattice Crypto Attacks3.7K
- Symmetric Cipher Attacks3.7K
- Windows Lateral Movement3.7K
- Macos Security Bypass3.7K
- Ntlm Relay Coercion3.7K
- Nosql Injection3.7K
- Macos Process Injection3.7K
- Upload Insecure Files3.7K
- Unauthorized Access Common Services3.6K
- Reverse Shell Techniques3.6K
- Ghost Bits Cast Attack3.5K
- Hack4.6K
- Android Pentesting Tricks4.3K
- Recon And Methodology4.3K
Recommended
cavemanjuliusbrussee/cavemanUltra-compressed communication mode. Cuts output tokens 65% (measured) by speaking like caveman while keeping full technical accuracy. Supports intensity levels618.3Kskills.sh installs
improveshadcn/improveSurvey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER models/agents to execute. Strictly read-only on s40Kskills.sh installs
systematic-debuggingobra/superpowersUse when encountering any bug, test failure, or unexpected behavior, before proposing fixes326.7Kskills.sh installs
karpathy-guidelinesforrestchang/andrej-karpathy-skillsBehavioral guidelines to reduce common LLM coding mistakes through explicit assumptions, simplicity, and verifiable success criteria.17.9Kskills.sh installs
find-skillsvercel-labs/skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express int4.3Mskills.sh installs