R-Services
R-services are the insecure ancestor of SSH — remote access built on trust rather than authentication. A single+in a.rhostsfile tells the host to trust anyone, and you log in as another user with no password at all. Rare today, but when you find them, they’re a free foothold.
Protocol: TCP · Ports: 512, 513, 514
What Are R-Services?
R-services were the de facto standard for remote access between Unix systems until SSH replaced them, precisely because of their built-in security flaws. Like telnet, they transmit everything — passwords, login info — unencrypted over the network, making them trivial to intercept with a man-in-the-middle attack. They span TCP ports 512, 513, and 514 and are accessed through a suite of programs called r-commands:| Command | Daemon | Port | Description |
|---|---|---|---|
rcp | — | 514 | Remote copy — copy files between hosts |
rexec | rexecd | 512 | Remote execution — run a command on a remote host |
rlogin | rlogind | 513 | Remote login — like telnet, but trust-based |
rsh | rshd | 514 | Remote shell — run commands without logging in |
rwho | rwhod | 513/udp | List who’s logged in across the local network |
rusers | — | — | Detailed list of logged-in users network-wide |
Default Configuration
The trust model lives in two files:/etc/hosts.equiv— a system-wide list of trusted hosts. Users from these hosts are granted access without further authentication.~/.rhosts— a per-user version of the same idea.
hosts.equiv and .rhosts short-circuit that with a list of trusted host/user pairs.
Entries follow the syntax <username> <ip-or-hostname>:
+ modifier is a wildcard meaning “anything.” In the example above, the + 10.0.17.10 line lets any external user access r-commands from the htb-student account via the host at 10.0.17.10.
Footprinting the Service
Scanning for R-Services
Logging in with rlogin
When.rhosts is misconfigured, rlogin gets you onto the host as the trusted user with no password:
.rhosts misconfiguration paying off.
Listing Logged-in Users with rwho
Once in,rwho lists all interactive sessions on the local network (it queries UDP port 513):
htb-student is on workstn01 and root is logged into web01, all useful targets for further attacks.
The
rwho daemon periodically broadcasts logged-on-user info across the
network, so watching the traffic over time can surface users and hosts you’d
otherwise miss.More Detail with rusers
rusers gives a fuller picture than rwho — username, hostname, the TTY they’re on, login date/time, idle time, and the remote host they connected from:
Quick Reference
| Command | Purpose |
|---|---|
nmap -sV -p512,513,514 <ip> | Detect r-services |
rlogin <ip> -l <user> | Log in as a trusted user (no password if misconfigured) |
rsh <ip> <command> | Run a command remotely |
rwho | List logged-in users on the network |
rusers -al <ip> | Detailed logged-in user info |
hosts.equiv / .rhosts. A + wildcard means trust-anyone — log in as another user with no credentials.
The footprinting flow: nmap for 512–514 → attempt rlogin against likely users → enumerate the network with rwho/rusers for more usernames and hosts to target.
Next: IPMI — baseboard management controllers and the infamous hash-retrieval flaw.