Skip to main content

​
R-Services

R-services are the insecure ancestor of SSH — remote access built on trust rather than authentication. A single + in a .rhosts file tells the host to trust anyone, and you log in as another user with no password at all. Rare today, but when you find them, they’re a free foothold.
Protocol: TCP · Ports: 512, 513, 514

​
What Are R-Services?

R-services were the de facto standard for remote access between Unix systems until SSH replaced them, precisely because of their built-in security flaws. Like telnet, they transmit everything — passwords, login info — unencrypted over the network, making them trivial to intercept with a man-in-the-middle attack. They span TCP ports 512, 513, and 514 and are accessed through a suite of programs called r-commands:

​
Default Configuration

The trust model lives in two files:
  • /etc/hosts.equiv — a system-wide list of trusted hosts. Users from these hosts are granted access without further authentication.
  • ~/.rhosts — a per-user version of the same idea.
By default these services use PAM (Pluggable Authentication Modules) for authentication, but hosts.equiv and .rhosts short-circuit that with a list of trusted host/user pairs. Entries follow the syntax <username> <ip-or-hostname>:
The + modifier is a wildcard meaning “anything.” In the example above, the + 10.0.17.10 line lets any external user access r-commands from the htb-student account via the host at 10.0.17.10.
A + in hosts.equiv or .rhosts is the misconfiguration that defines R-services exploitation. + + (trust any user from any host) is the worst case — it lets you authenticate as another user with no credentials at all, often leading straight to code execution.

​
Footprinting the Service

​
Scanning for R-Services

​
Logging in with rlogin

When .rhosts is misconfigured, rlogin gets you onto the host as the trusted user with no password:
That successful login with no credentials is the .rhosts misconfiguration paying off.

​
Listing Logged-in Users with rwho

Once in, rwho lists all interactive sessions on the local network (it queries UDP port 513):
This is a username goldmine — here you can see htb-student is on workstn01 and root is logged into web01, all useful targets for further attacks.
The rwho daemon periodically broadcasts logged-on-user info across the network, so watching the traffic over time can surface users and hosts you’d otherwise miss.

​
More Detail with rusers

rusers gives a fuller picture than rwho — username, hostname, the TTY they’re on, login date/time, idle time, and the remote host they connected from:

​
Quick Reference

The key file: hosts.equiv / .rhosts. A + wildcard means trust-anyone — log in as another user with no credentials. The footprinting flow: nmap for 512–514 → attempt rlogin against likely users → enumerate the network with rwho/rusers for more usernames and hosts to target.
Next: IPMI — baseboard management controllers and the infamous hash-retrieval flaw.