# r-services

> Legacy Unix remote login

- **URL:** https://hackindex.io/services/r-services
- **Type:** Service
- **Default ports:** 512, 513, 514
- **Tags:** rlogin, unix, remote-access, legacy, cleartext, linux
- **Published:** 2026-01-26
- **Updated:** 2026-07-14

R-Services are a suite of legacy Unix remote access tools: rlogin, rsh, and rexec. They run on **TCP port 512** (rexec), **TCP port 513** (rlogin), and **TCP port 514** (rsh). Nmap identifies them as `exec`, `login`, and `shell` respectively.

These services were designed for trusted networks and predate modern authentication. Rlogin and rsh use host-based trust via `.rhosts` and `/etc/hosts.equiv` files, meaning an attacker who controls a trusted host (or can spoof its IP) gains access without any password. Rexec transmits credentials in cleartext. All three protocols send data unencrypted, making them vulnerable to sniffing and session hijacking.

Enumeration involves checking which r-services are running and testing for trust relationships. Attempting `rlogin -l root <target>` from known network ranges can reveal passwordless access. The `.rhosts` files on compromised hosts list trusted host/user pairs that open lateral movement paths. Any environment still running r-services likely has other legacy configurations worth investigating.

## Phases

- [Enumeration](https://hackindex.io/services/r-services/enumeration.md): Guides for enumerating rsh and rlogin trust-based access (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/r-services/vulnerability-discovery.md): (1 guides)
- [Exploitation](https://hackindex.io/services/r-services/exploitation.md): (1 guides)