skills.rest
Prohao42
Prohao42COMMUNITY
Explore all skills by this author →
GitHub

linux-lateral-movement

Automate lateral movement across Linux hosts using SSH agent hijacking and credential harvesting.

120|8|Updated Jun 2, 2026
Search Tags:#penetration testing#linux#lateral movement#credential harvesting#D-Bus#sudo token reuse#systemd exploitation
One-click install
npx skills add https://github.com/Prohao42/aimy-skill --skill linux-lateral-movement
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: linux-lateral-movement
Source: https://github.com/Prohao42/aimy-skill/tree/main/ai-mian/hack-skills/skills/linux-lateral-movement
Command: npx skills add https://github.com/Prohao42/aimy-skill --skill linux-lateral-movement

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires paramiko, python, netifaces, psutil, pyssh, paramiko, sshtunnel, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill enables penetration testers to bypass security controls and move laterally across Linux-based systems post-compromise, identifying critical assets and exfiltrating data.

Core Features & Use Cases

  • SSH Agent Hijacking: Bypass SSH authentication to use victim credentials for lateral movement.
  • Key Harvesting: Extract and utilize private keys from the victim's environment.
  • Credential Harvesting: Harvest system, environment, and configuration credentials for lateral movement.
  • D-Bus Exploitation: Abuse systemd and PolicyKit through D-Bus services for privileged access.
  • Network Pivoting: Use SSH tunnels and alternative port forwarding to access internal networks.
  • Shared Filesystem Abuse: Exploit mounted file shares to spread laterally across networks.
  • Sudo Token Reuse: Hijack sudo sessions to maintain persistence without requiring credentials.
  • Systemd Service Manipulation: Inject code into systemd services for a persistent backdoor.

Quick Start

Run the skill with 'use linux-lateral-movement -target http://target-machine -ssh-user user -ssh-pass secret' to begin the lateral movement process on a Linux host.

Frequently Asked Questions about linux-lateral-movement

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Linux lateral movement after an initial compromise?▼

Automating Linux lateral movement post-compromise requires executing techniques like SSH agent hijacking, credential harvesting, and network pivoting to propagate across systems and escalate privileges.

How does sudo token reuse work for privilege escalation?▼

Sudo token reuse for privilege escalation works by hijacking active sudo sessions to maintain persistence and execute privileged commands without requiring the user to re-enter credentials.

Can I exploit D-Bus services to abuse systemd and PolicyKit on Linux?▼

Yes, you can exploit D-Bus services to abuse systemd and PolicyKit, enabling privileged access and allowing the injection of code into systemd services for a persistent backdoor.

What is the best way to harvest credentials for Linux network pivoting?▼

The best way to harvest credentials for Linux network pivoting involves extracting private keys, system credentials, and configuration data, then using SSH tunnels and port forwarding to access internal networks.

Do I need Python and Paramiko to perform SSH agent hijacking?▼

Yes, performing SSH agent hijacking and network pivoting requires Python environments utilizing dependencies like Paramiko and sshtunnel to establish connections and bypass SSH authentication.

Related Skills

Explore More Software Engineering Skills→
MathiasPaulenkoMathiasPaulenko

paramiko-ssh

Automate remote server commands and SFTP transfers using Paramiko.

Community
Advanced
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
zebbernzebbern
4.5k

SSH Penetration Testing

Automate SSH security assessments with enumeration, credential attacks, and vulnerability exploitation.

Community
Advanced