r-services

R-Services are a suite of legacy Unix remote access tools: rlogin, rsh, and rexec. They run on TCP port 512 (rexec), TCP port 513 (rlogin), and TCP port 514 (rsh). Nmap identifies them as exec, login, and shell respectively.

These services were designed for trusted networks and predate modern authentication. Rlogin and rsh use host-based trust via .rhosts and /etc/hosts.equiv files, meaning an attacker who controls a trusted host (or can spoof its IP) gains access without any password. Rexec transmits credentials in cleartext. All three protocols send data unencrypted, making them vulnerable to sniffing and session hijacking.

Enumeration involves checking which r-services are running and testing for trust relationships. Attempting rlogin -l root <target> from known network ranges can reveal passwordless access. The .rhosts files on compromised hosts list trusted host/user pairs that open lateral movement paths. Any environment still running r-services likely has other legacy configurations worth investigating.