PT2 · Module 11
SSH & Linux Lateral Movement
Authenticate, hijack forwarded agents, escape ForceCommand shells, chain tunnels, and pivot through harvested keys across Linux infrastructure.
~8 h 14 resources Last updated October 4, 2026
SSH is the backbone of Linux administration and the preferred lateral-movement channel in modern infrastructure. Each feature that solves a sysadmin problem (agent forwarding, certificate authorities, ForceCommand, port forwarding) trades it for a new trust assumption. PT2 tests whether you can enumerate those assumptions, exploit the one that broke, and pivot through the resulting access without triggering a failed-login alert.
Authentication Surface
Baseline before any attack: which auth methods the server offers, what AuthenticationMethods enforces (AND via comma, OR via space), and whether the client even validates host keys. Weak defaults (PermitRootLogin yes, PasswordAuthentication yes, missing AllowUsers) all surface at this stage. User enumeration via timing and auth-method response differences feeds the credential attacks.
Credential Attacks
Password spraying with a curated username list is the default. Key-based attacks test harvested private keys for reuse across hosts. Empty-passphrase keys and cracked passphrase-protected keys both land you authenticated access with no detectable brute-force signal.
Agent Hijack And ForceCommand Escape
Agent forwarding exposes a socket at /tmp/ssh-*/agent.* (pre-10.1) or ~/.ssh/agent/ (10.1+). Root bypasses the Unix permissions guarding it, so a forwarded agent socket on a compromised bastion lets you authenticate onward as whoever owns the agent. ForceCommand restricts a session to one fixed command, but if the wrapper interpolates $SSH_ORIGINAL_COMMAND or an AcceptEnv-permitted variable into an eval, you escape the restriction without needing elevated access.
Lateral Movement
Once in, harvest keys from ~/.ssh, map reachable hosts via known_hosts, authorized_keys, and ssh_config. Credential reuse validation walks a target list cheaply. For pivoting, local forwarding (-L) exposes one internal target, remote forwarding (-R) exposes your side back, and dynamic forwarding (-D) turns your box into a SOCKS proxy for anything the compromised host can reach.
Persistence
Authorized keys backdoors, shell-profile hooks, cron entries under the SSH user, and sshd config manipulation each survive different cleanup actions. Pick based on the admin's monitoring rather than convenience.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.
-
Guide 2 min readSSH User Enumeration
-
Guide 4 min readSSH Lateral Movement with Harvested Keys