R-Services 512,513,514

Basic Information

It is a service that allows you to execute a command inside a host if you know valid credentials (username and password).

Default Port: 512

PORT    STATE SERVICE
512/tcp open  exec

Basic Information

This service was mostly used in the old days for remote administration but now because of security issues this service has been replaced by the slogin and the ssh.

Default port: 513

Copy

PORT    STATE SERVICE
513/tcp open  login

Login

Copy

apt-get install rsh-client

This command will try to login to the remote host by using the login name root (for this service you don't need to know any password):

Copy

rlogin <IP> -l <username>

Brute force

Find files

Copy

find / -name .rhosts

Basic Information

Rsh use .rhosts files and /etc/hosts.equiv for authentication. These methods relied on IP addresses and DNS (Domain Name System) for authentication. However, spoofing IP addresses is fairly easy, especially if the attacker is on the local network.

Furthermore, the .rhosts files were stored in users' home directories, which were typically stored on NFS (Network File System) volumes. (from here: https://www.ssh.com/ssh/rsh).

Default port: 514

Login

Copy

rsh <IP> <Command>
rsh <IP> -l domain\user <Command>
rsh domain/user@<IP> <Command>
rsh domain\\user@<IP> <Command>