# SSH & Linux Lateral Movement

> Authenticate, hijack forwarded agents, escape ForceCommand shells, chain tunnels, and pivot through harvested keys across Linux infrastructure.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 8
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

SSH is the backbone of Linux administration and the preferred lateral-movement channel in modern infrastructure. Each feature that solves a sysadmin problem (agent forwarding, certificate authorities, ForceCommand, port forwarding) trades it for a new trust assumption. PT2 tests whether you can enumerate those assumptions, exploit the one that broke, and pivot through the resulting access without triggering a failed-login alert.

## Authentication Surface

Baseline before any attack: which auth methods the server offers, what `AuthenticationMethods` enforces (AND via comma, OR via space), and whether the client even validates host keys. Weak defaults (`PermitRootLogin yes`, `PasswordAuthentication yes`, missing `AllowUsers`) all surface at this stage. User enumeration via timing and auth-method response differences feeds the credential attacks.

## Credential Attacks

Password spraying with a curated username list is the default. Key-based attacks test harvested private keys for reuse across hosts. Empty-passphrase keys and cracked passphrase-protected keys both land you authenticated access with no detectable brute-force signal.

## Agent Hijack And ForceCommand Escape

Agent forwarding exposes a socket at `/tmp/ssh-*/agent.*` (pre-10.1) or `~/.ssh/agent/` (10.1+). Root bypasses the Unix permissions guarding it, so a forwarded agent socket on a compromised bastion lets you authenticate onward as whoever owns the agent. ForceCommand restricts a session to one fixed command, but if the wrapper interpolates `$SSH_ORIGINAL_COMMAND` or an `AcceptEnv`-permitted variable into an `eval`, you escape the restriction without needing elevated access.

## Lateral Movement

Once in, harvest keys from `~/.ssh`, map reachable hosts via `known_hosts`, `authorized_keys`, and `ssh_config`. Credential reuse validation walks a target list cheaply. For pivoting, local forwarding (`-L`) exposes one internal target, remote forwarding (`-R`) exposes your side back, and dynamic forwarding (`-D`) turns your box into a SOCKS proxy for anything the compromised host can reach.

## Persistence

Authorized keys backdoors, shell-profile hooks, cron entries under the SSH user, and sshd config manipulation each survive different cleanup actions. Pick based on the admin's monitoring rather than convenience.

## Study material

- [SSH Authentication Method Enumeration](https://hackindex.io/services/ssh/enumeration/ssh-authentication-method-enumeration.md) (read, core)
- [SSH User Enumeration](https://hackindex.io/services/ssh/enumeration/ssh-user-enumeration.md) (read, core)
- [SSH Weak Authentication Configuration](https://hackindex.io/services/ssh/vulnerability-discovery/ssh-weak-authentication-configuration.md) (read, core)
- [SSH Password Credential Attacks](https://hackindex.io/services/ssh/exploitation/ssh-password-credential-attacks.md) (read, core)
- [SSH Key-Based Authentication Testing](https://hackindex.io/services/ssh/exploitation/ssh-key-based-authentication-testing.md) (read, core)
- [SSH Agent Socket Discovery](https://hackindex.io/services/ssh/post-exploitation/ssh-agent-socket-discovery.md) (read, core)
- [SSH Agent Hijacking for Lateral Movement](https://hackindex.io/services/ssh/lateral-movement/ssh-agent-hijacking.md) (read, core)
- [SSH Authorized Keys ForcedCommand and Wrapper Audit](https://hackindex.io/services/ssh/post-exploitation/ssh-authorized-keys-forcedcommand-audit.md) (read, core)
- [SSH Private Key Discovery and Passphrase Cracking](https://hackindex.io/services/ssh/post-exploitation/ssh-private-key-discovery-and-passphrase-cracking.md) (read, core)
- [SSH Config and Known Hosts Enumeration](https://hackindex.io/services/ssh/post-exploitation/ssh-config-and-known-hosts-enumeration.md) (read, core)
- [SSH Credential Reuse Validation](https://hackindex.io/services/ssh/lateral-movement/ssh-credential-reuse-validation.md) (read, core)
- [SSH Lateral Movement with Harvested Keys](https://hackindex.io/services/ssh/lateral-movement/ssh-lateral-movement-harvested-keys.md) (read, core)
- [SSH Port Forwarding and Tunneling](https://hackindex.io/services/ssh/lateral-movement/ssh-port-forwarding-tunneling.md) (read, core)
- [SSH Persistence Techniques](https://hackindex.io/services/ssh/persistence/ssh-persistence.md) (read, core)