SSH Agent Hijacking for Lateral Movement
Mar 16, 2026
•
3 min read
SSH:
Lateral Movement
SSH pivoting via keys, agents, credential reuse, and tunneling
4 guides
•
Created Dec 28, 2025
•
Updated Mar 29, 2026
SSH Credential Reuse Validation
Validates reused SSH credentials across internal hosts to identify lateral movement paths via password/key reuse in networked environments.
Jan 3, 2026
•
3 min read
SSH Lateral Movement with Harvested Keys
Techniques for moving laterally through networks using harvested SSH private keys, covering key discovery, agent hijacking, and hop chaining.
Mar 16, 2026
•
4 min read
SSH Port Forwarding and Tunneling
Mar 16, 2026
•
4 min read
SSH is the primary lateral movement protocol in Linux and Unix environments. Key-based pivoting works when private keys found on a compromised host are accepted by other systems. Check ~/.ssh/ directories for id_rsa, id_ed25519, and any non-standard key files, then test them against hosts listed in known_hosts and SSH configs.
Agent forwarding abuse lets you use a connected user's keys without ever reading them from disk. If someone connects to your compromised host with ssh -A, their agent socket is available to root. ProxyJump (-J) and ProxyCommand chaining create multi-hop paths through environments where direct connectivity between segments does not exist.
Credential reuse is the simplest vector: passwords or keys that work on one host frequently work on others, especially in environments with shared service accounts or configuration management that distributes the same authorized_keys file. Each new host you reach expands both your credential collection and your network visibility for the next hop.