# SSH Agent Socket Discovery

- **URL:** https://hackindex.io/services/ssh/post-exploitation/ssh-agent-socket-discovery
- **Path:** SSH > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/services/ssh/post-exploitation.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

The SSH agent holds decrypted private keys in memory and handles authentication on behalf of the user. After gaining shell access, finding active agent sockets tells you what keys are available without needing to crack or steal the key files themselves. A reachable agent socket can authenticate to any host where the loaded key is authorised.

This page covers locating and inspecting agent sockets. Using them to reach other hosts is covered in [SSH Agent Hijacking for Lateral Movement](https://hackindex.io/services/ssh/lateral-movement/ssh-agent-hijacking).

## Find Active Agent Sockets

Agent sockets are created in `/tmp` with a path like `/tmp/ssh-XXXXXX/agent.PID`:

```bash
find /tmp /run -name "agent.*" -type s 2>/dev/null
ls /tmp/ssh-*/agent.* 2>/dev/null
```

As root, all sockets on the system are visible. As a regular user, only your own sockets are shown unless permissions are misconfigured.

Check running processes for their `SSH_AUTH_SOCK` environment variable:

```bash
ps auxe 2>/dev/null | grep SSH_AUTH_SOCK
```

Search `/proc` directly for any process with an agent socket in its environment:

```bash
grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | head -10
# /proc/1842/environ:...SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841...
```

This returns the full socket path including PID. The socket belongs to whichever user owns that process.

## Check Socket Permissions

A socket belonging to another user is only accessible if you are root, or if the permissions are misconfigured:

```bash
ls -la /tmp/ssh-XYZ123/agent.1841
# srwxrwxrwx 1 admin admin 0 Mar 10 09:00 /tmp/ssh-XYZ123/agent.1841
```

World-writable (`srwxrwxrwx`) means any user can connect. Standard permissions (`srw-------`) require root or ownership.

## Inspect Loaded Keys

Before hijacking, check what keys the agent holds and which hosts they grant access to:

```bash
SSH_AUTH_SOCK=/tmp/ssh-XYZ123/agent.1841 ssh-add -l
# 2048 SHA256:abc123... /home/admin/.ssh/id_rsa (RSA)
# 4096 SHA256:def456... /root/.ssh/deploy_key (RSA)
```

Cross-reference these fingerprints against `authorized_keys` files on other hosts if you have that information, or against keys found in `~/.ssh/config` to identify which hosts each key accesses.

## Check Agent Forwarding State

If the current session arrived via SSH with agent forwarding enabled, `SSH_AUTH_SOCK` is already set in your environment:

```bash
echo $SSH_AUTH_SOCK
```

A non-empty value means the original user's agent is forwarded into this session. The keys loaded in that agent are immediately usable:

Places to look for agent socket references:

- `/tmp/ssh-*/agent.*` for standard socket paths
- `/proc/*/environ` for `SSH_AUTH_SOCK` in process environments
- `$SSH_AUTH_SOCK` in the current shell for forwarded agents
- `ps auxe` output for processes with agent variables

```bash
ssh-add -l
```

Agent forwarding means you can chain further SSH connections to any host the forwarded keys authorise, without ever seeing the private key files.

## Identify Which Sessions Have Forwarded Agents

On a multi-user system, check which logged-in sessions have forwarding active:

```bash
who
w
last | head -20
```

Then correlate with process environments:

```bash
for pid in $(pgrep sshd); do
  env_file="/proc/$pid/environ"
  if [ -r "$env_file" ]; then
    sock=$(tr '\0' '\n' < "$env_file" 2>/dev/null | grep SSH_AUTH_SOCK | cut -d= -f2)
    if [ -n "$sock" ]; then
      echo "PID $pid: $sock"
    fi
  fi
done
```

Each socket path found this way represents an active session with a loaded agent. Take these paths into [SSH Agent Hijacking for Lateral Movement](https://hackindex.io/services/ssh/lateral-movement/ssh-agent-hijacking).

## References

- [ssh-agent(1): OpenBSD manual page](https://man.openbsd.org/ssh-agent.1) - Reference for SSH agent operation, socket location, and the SSH_AUTH_SOCK variable
- [ssh-add(1): OpenBSD manual page](https://man.openbsd.org/ssh-add.1) - Reference for listing and managing keys loaded in a running SSH agent