Credential reuse
Credential reuse tests credentials discovered during the engagement against additional systems and services. It is one of the simplest and most consistently effective escalation techniques because it exploits people and organizations that reuse passwords rather than a technical vulnerability.
Strategic context
Credentials are commonly discovered throughout an engagement: extracted from databases, captured through poisoning, found in configuration files, or saved on SharePoint. Each discovered credential could enable elevated privileges or access to additional systems.
The principle is straightforward. A password that works on one system often works on others. A local administrator password set through Group Policy may be identical across dozens of machines. A user's application password may be the same as their domain password.
Credential reuse testing should be the first escalation technique attempted after credentials are obtained, before pursuing more complex technical escalation paths.
For security leaders, credential reuse highlights the compound risk of any single credential exposure. A compromised password for a low-priority system becomes a high-priority issue if the same password is used for domain authentication, VPN access, or administrative accounts. Password managers, unique passwords per service, and credential monitoring are the primary defenses.
Execution examples
Testing credentials across services
When domain credentials are discovered, test them against accessible services:
# SMB authentication across subnet
nxc smb SUBNET/24 -u user -p 'discovered_password'
# SSH
nxc ssh SUBNET/24 -u user -p 'discovered_password'
# WinRM
nxc winrm SUBNET/24 -u user -p 'discovered_password'Local administrator password reuse
Local administrator passwords configured through imaging, scripts, or Group Policy are often identical across multiple machines:
A single match provides access to that host. Multiple matches suggest systematic reuse.
Hash-based authentication
When NTLM hashes are obtained but not cracked, they can still be used for authentication through pass-the-hash:
Service account credential testing
Service account passwords discovered in configuration files, scripts, or registry entries should be tested against domain authentication:
Service accounts frequently have elevated privileges that their passwords do not reflect in complexity.
Common mistakes
Pursuing complex technical escalation before testing discovered credentials
Testing only against the same service where the credential was found
Not testing local administrator credentials across the subnet
Failing to document which credentials work where
Operator notes
Credential reuse testing should be attempted before technical escalation techniques
Test every discovered credential against every accessible authentication service
Local administrator password reuse is common and may lead to domain escalation
Even partial credential reuse, where the same base password is used with minor variations, is worth noting in reports as it suggests a behavior
Track all credential discoveries and reuse findings carefully for reporting
Last updated