Intranet Security-Lateral Movement

windows landscape

/Machikanzen/

linux landscape

Sensitive documents

~/.ssh/config #Configure the configuration file for ssh connection related parameters

~/.ssh/known_hosts # Information about all servers logged in to this server

~/.bash_history # We can use the history command to see whether the server uses the ssh private key to remotely connect to the server.

Search for files containing SSH credentials

grep -ir “BEGIN RSA PRIVATE KEY” /*

grep -ir “BEGIN DSA PRIVATE KEY” /*

grep -ir “BEGIN OPENSSH PRIVATE KEY” /*