R-Services Abuse (rlogin, rsh, rexec)

R-Services are a family of Berkeley services for remote access and execution between Unix hosts (rlogin, rsh, rexec, rcp, rwho, rusers). They span ports 512, 513 and 514, and like telnet they transmit everything (credentials included) in cleartext. SSH replaced them precisely because of their design flaws, but they still show up on older commercial systems (Solaris, AIX, HP-UX) during internal engagements. Their weak point is the trust model: the /etc/hosts.equiv (global) and ~/.rhosts (per-user) files define host/user pairs that authenticate without a password.

Mechanism

First confirm the ports with a version scan:

nmap -sV -p 512,513,514 <ip>

PORT    STATE SERVICE VERSION
512/tcp open  exec?
513/tcp open  login?
514/tcp open  tcpwrapped

The key is the trust files. An entry follows the format <user> <host>, and the + wildcard means "anyone". A misconfigured .rhosts like the following lets any host log in as that user with no credentials:

htb-student     10.0.17.5
+               10.0.17.10
+               +

With the rsh-client package installed, we log in by leveraging the trust relationship:

rlogin <ip> -l <user>

Once inside, rwho and rusers reveal more users and active sessions across the network, useful for the next hop:

rwho
rusers -al <ip>

rexec does ask for a username and password (over an unencrypted socket), unless a trust entry overrides it.

Requirements

Logging in without credentials requires a trust entry in hosts.equiv or .rhosts (ideally with the + wildcard). Failing that, valid credentials work for rexec, and it is always worth trying reuse with any you have collected in the environment. On the attacker side you need the r-client package (apt install rsh-client).

How to detect it

The attack is given away by cleartext traffic on 512/513/514 (an IDS reads the credentials directly), rlogin and rsh logins from untrusted IPs, and, on the host, the presence of .rhosts or hosts.equiv files with + entries. The rlogind, rshd and rexecd daemons log every connection.

Defence. Uninstall R-Services and use SSH; remove hosts.equiv and any .rhosts; if compatibility makes them unavoidable, use explicit host/user entries, never the + wildcard, and restrict access by firewall. Related to SSH user enumeration, anonymous FTP, rsync enumeration and credential reuse.