SSH caches keys of ongoing sessions in /tmp. Root can hijack, SSH to machine

by frogger8on 2/28/2023, 8:58:51 PM with 2 comments
  • by theamkon 2/28/2023, 10:10:01 PM

    Someone discovered either "ssh-agent" or ssh agent forwarding.

    I bet the next tweet from that account is: "Red Teamers: Check out ~/.ssh for user ssh keys! root user can hijack them and SSH to any machine the user can access"

  • by gladiatr72on 3/1/2023, 1:27:28 AM

    Um. Yeah. That's kinda how that whole root thing works.