28 lines
928 B
Markdown
28 lines
928 B
Markdown
# Linux Credential Pivot Checklist
|
|
|
|
## First Pass
|
|
|
|
- SSH keys, agent sockets, kubeconfigs, cloud tokens, service-account secrets
|
|
- Env vars, config files, systemd units, sudoers, capabilities, setuid binaries
|
|
- Namespace context, container runtime sockets, control-plane endpoints
|
|
|
|
## Chain To Reconstruct
|
|
|
|
1. Credential artifact recovered
|
|
2. Accepting service identified
|
|
3. Replay or auth path executed
|
|
4. New session, token, or privilege gained
|
|
5. Pivot or lateral effect reproduced
|
|
|
|
## Evidence To Keep Together
|
|
|
|
- Artifact side: file or socket path, owner, scope, lifetime
|
|
- Replay side: target host, service, protocol, principal
|
|
- Effect side: privilege change, new shell, control-plane action, lateral movement
|
|
|
|
## Common Pitfalls
|
|
|
|
- Listing secrets without proving acceptance on a target service
|
|
- Mixing local privilege escalation and lateral movement in one vague chain
|
|
- Ignoring namespace or socket ownership context
|