Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.

SKILL: Linux Lateral Movement — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH AUTH SOCK hijacking and ptrace based sudo session hijack. 0. RELATED ROUTING Before going deep, consider loading: [linux privilege escalation](../linux privilege escalation/SKILL.md) if you need root on the current host before pivoting [linux security bypass](../linux security bypass/SKILL.md) when restricted shells or security modules block lateral movement tools [container escape techniques](../container escape techniques/SKILL.md) when the target network includes containerized hosts [kubernetes pentesting](../kubernetes pentesting/SKILL.md) when pivoting into a Kubernetes cluster [unauthorized access common services](../unauthorized access common services/SKILL.md) for exploiting discovered internal services (Redis, MongoDB, etc.) 1. SSH AGENT HIJACKING 1.1 Find SSH Agent Sockets 1.2 Hijack Agent Forwarding 1.3 Persistent Agent Monitoring 2. SSH KEY HARVESTING 2.1 Private Key Locations 2.2 known hosts Parsing 2.3 authorized keys Injection 3. CREDENTIAL HARVESTING LOCATIONS 3.1 System Credentials Location Contents Command /etc/shadow Password hashes cat /etc/shadow (root) /etc/passwd User list, may contain hashes cat /etc/passwd .bash history Command history (passwords in cleartext) cat /home/ /.bash history .mysql history MySQL commands with passwords cat /home/ /.mysql history .psql history PostgreSQL commands cat /home/ /.psql history .pgpass PostgreSQL password file cat /home/ /.pgpass .my.cnf MySQL credentials cat /home/ /.my.cnf .netrc FTP/HTTP auto login credentials cat /home/ /.netrc .git credentials Git HTTPS passwords cat /home/ /.git credentials 3.2 Environment & Config Files 4. D BUS EXPLOITATION 4.1 Enumerate D Bus Services 4.2 Abuse systemd & PolicyKit via D Bus 5. INTERNAL NETWORK PIVOTING 5.1 SSH Tunneling 5.2 Without SSH — Alternative Tunnels 5.3 Network Discovery from Compromised Host 6. SHARED FILESYSTEM EXPLOITATION 6.1 NFS Mounts 6.2 SMB/CIFS Shares 7. SUDO TOKEN REUSE (ptrace Based) 8. SYSTEMD SERVICE MANIPULATION 9. LATERAL MOVEMENT DECISION TREE

linux-lateral-movement