# SSH Credential Reuse Validation

> Validates reused SSH credentials across internal hosts to identify lateral movement paths via password/key reuse in networked environments.

- **URL:** https://hackindex.io/services/ssh/lateral-movement/ssh-credential-reuse-validation
- **Path:** SSH > Lateral Movement
- **Up:** [Lateral Movement](https://hackindex.io/services/ssh/lateral-movement.md)
- **Published:** 2026-01-03
- **Updated:** 2026-08-11

Once you have working SSH credentials, project them across the estate to find where reuse exists and where it stops. Admin accounts frequently reuse passwords across hosts. Service accounts are worse. A single cracked credential often opens five to twenty machines in a flat internal network.

## SSH Credential Reuse Testing Across a Target List

NetExec is the standard tool for this. Feed it a target list, one host per line. It attempts auth against every host in parallel and marks each result clearly.

```bash
nxc ssh targets.txt -u $USERNAME -p $PASSWORD
# [*]  192.168.1.10  SSH  22  [+] admin:Password123 (Pwn3d!)
# [*]  192.168.1.12  SSH  22  [-] admin:Password123  Authentication failed
```

`[+]` confirms the credential works. `Pwn3d!` indicates command execution is also available. Any host returning `[+]` is a lateral movement target. Note hosts returning authentication failures separately ,  they are still in scope but require a different credential.

Capture output to disk while keeping stdout live:

```bash
nxc ssh targets.txt -u $USERNAME -p $PASSWORD | tee ssh_reuse_results.txt
```

Filter the results for successful hits only:

```bash
grep '\[+\]' ssh_reuse_results.txt | awk '{print $2}'
```

That extracts IP addresses of confirmed valid hosts for follow-up enumeration.

## Cross-Protocol Reuse

SSH credentials often work on SMB, WinRM, and RDP on the same host. Test other services against the confirmed hit list before moving on.

```bash
nxc smb targets.txt -u $USERNAME -p $PASSWORD
nxc winrm targets.txt -u $USERNAME -p $PASSWORD
nxc rdp targets.txt -u $USERNAME -p $PASSWORD
```

SMB hits expose share access and potentially lateral movement via psexec. WinRM hits give direct PowerShell remoting. RDP is GUI access, useful when other methods are blocked.

## Keep It Controlled

SSH services degrade under high connection volume. Timeouts and resets usually mean load or defensive rate limiting has kicked in. Batch targets instead of pushing all at once.

```bash
split -l 50 targets.txt targets_chunk_
for f in targets_chunk_*; do
  nxc ssh "$f" -u $USERNAME -p $PASSWORD | tee -a ssh_reuse_results.txt
done
```

Batches of 50 targets keep connection rate reasonable on most networks. Adjust down if services start returning connection errors. Add `sleep 2` between batches in sensitive environments.

## Username Variations

If the credential fails across the estate, try common username variations before discarding it. Admins reuse passwords with different account names:

```bash
nxc ssh targets.txt -u users.txt -p $PASSWORD --continue-on-success
```

`--continue-on-success` prevents NetExec from stopping after the first valid hit per host. Without it, one valid credential per target is all you get. With it, you find every account on every host that accepts the password. Useful when accounts differ by host but share a password.

Common username variations to test:

- `admin`, `administrator`, `sysadmin`
- `deploy`, `ansible`, `jenkins`
- First name or first initial + last name patterns
- Service-specific accounts (`postgres`, `git`, `www-data`)

## References

- [NetExec](https://github.com/Pennyw0rth/NetExec) - Multi-target SSH auth validation for reuse testing.