SSH:

Post-Exploitation

SSH keys, agents, configs, and backdoor auditing guides

4 guides • Created Dec 28, 2025 • Updated Mar 29, 2026

4 guides

SSH Agent Socket Discovery

Mar 16, 2026 • 3 min read

SSH Authorized Keys ForcedCommand and Wrapper Audit

Jan 3, 2026 • 3 min read

SSH Config and Known Hosts Enumeration

Mar 16, 2026 • 3 min read

SSH Private Key Discovery and Passphrase Cracking

Locate SSH private keys on compromised hosts, extract them, and crack passphrases offline using John the Ripper or Hashcat to enable lateral movement.

Jan 3, 2026 • 4 min read

SSH post-exploitation harvests credentials and configuration data that enable further movement through the environment. The known_hosts file maps out which hosts the compromised user connects to, giving you a network graph of SSH relationships. If known_hosts is not hashed, you get plaintext hostnames and IPs. Even hashed entries can be cracked against known host lists.

SSH agent socket theft targets users with active agent forwarding. Enumerate /tmp/ssh-*/agent.* sockets and use SSH_AUTH_SOCK to hijack them. Private key collection from ~/.ssh/ directories, backup files, and configuration management caches (Ansible, Puppet, Chef) yields keys that often work across multiple hosts.

Analyze ~/.ssh/config files for ProxyJump definitions, custom ports, and username mappings that reveal infrastructure you have not scanned yet. SSH command history (in bash_history, grep for ssh/scp/sftp) shows connection patterns and sometimes includes passwords passed inline. Every credential and connection detail from this phase feeds directly into lateral movement.