Skip to content
HackIndex logo

HackIndex

SSH Agent Socket Discovery

3 min read Mar 16, 2026

The SSH agent holds decrypted private keys in memory and handles authentication on behalf of the user. After gaining shell access, finding active agent sockets tells you what keys are available without needing to crack or steal the key files themselves. A reachable agent socket can authenticate to any host where the loaded key is authorised.

This page covers locating and inspecting agent sockets. Using them to reach other hosts is covered in SSH Agent Hijacking for Lateral Movement.

Find Active Agent Sockets

Agent sockets are created in /tmp with a path like /tmp/ssh-XXXXXX/agent.PID:

┌──(kali㉿kali)-[~]
└─$ find /tmp /run -name "agent.*" -type s 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ls /tmp/ssh-*/agent.* 2>/dev/null

As root, all sockets on the system are visible. As a regular user, only your own sockets are shown unless permissions are misconfigured.

Check running processes for their SSH_AUTH_SOCK environment variable:

┌──(kali㉿kali)-[~]
└─$ ps auxe 2>/dev/null | grep SSH_AUTH_SOCK

Search /proc directly for any process with an agent socket in its environment:

┌──(kali㉿kali)-[~]
└─$ grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | head -10 
/proc/1842/environ:...SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841...

This returns the full socket path including PID. The socket belongs to whichever user owns that process.

Check Socket Permissions

A socket belonging to another user is only accessible if you are root, or if the permissions are misconfigured:

┌──(kali㉿kali)-[~]
└─$ ls -la /tmp/ssh-XYZ123/agent.1841 
srwxrwxrwx 1 admin admin 0 Mar 10 09:00 /tmp/ssh-XYZ123/agent.1841

World-writable (srwxrwxrwx) means any user can connect. Standard permissions (srw-------) require root or ownership.

Inspect Loaded Keys

Before hijacking, check what keys the agent holds and which hosts they grant access to:

┌──(kali㉿kali)-[~]
└─$ SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841 ssh-add -l 
2048 SHA256:abc123... /home/admin/.ssh/id_rsa (RSA)
4096 SHA256:def456... /root/.ssh/deploy_key (RSA)

Cross-reference these fingerprints against authorized_keys files on other hosts if you have that information, or against keys found in ~/.ssh/config to identify which hosts each key accesses.

Check Agent Forwarding State

If the current session arrived via SSH with agent forwarding enabled, SSH_AUTH_SOCK is already set in your environment:

┌──(kali㉿kali)-[~]
└─$ echo $SSH_AUTH_SOCK

A non-empty value means the original user's agent is forwarded into this session. The keys loaded in that agent are immediately usable:

┌──(kali㉿kali)-[~]
└─$ ssh-add -l

Agent forwarding means you can chain further SSH connections to any host the forwarded keys authorise, without ever seeing the private key files.

Identify Which Sessions Have Forwarded Agents

On a multi-user system, check which logged-in sessions have forwarding active:

┌──(kali㉿kali)-[~]
└─$ who
┌──(kali㉿kali)-[~]
└─$ w
┌──(kali㉿kali)-[~]
└─$ last | head -20

Then correlate with process environments:

for pid in $(pgrep sshd); do
  env_file="/proc/$pid/environ"
  if [ -r "$env_file" ]; then
    sock=$(tr '\0' '\n' < "$env_file" 2>/dev/null | grep SSH_AUTH_SOCK | cut -d= -f2)
    if [ -n "$sock" ]; then
      echo "PID $pid: $sock"
    fi
  fi
done

Each socket path found this way represents an active session with a loaded agent. Take these paths into SSH Agent Hijacking for Lateral Movement.

References