# rsh and rlogin Access Enumeration

- **URL:** https://hackindex.io/services/r-services/enumeration/rsh-and-rlogin-access-enumeration
- **Path:** r-services > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/r-services/enumeration.md)
- **Published:** 2026-01-26
- **Updated:** 2026-03-30

## rlogin Access Enumeration

R-services are a family of legacy remote access protocols that predate SSH. rsh (port 514) executes commands, rlogin (port 513) provides an interactive shell, and rexec (port 512) executes commands with explicit credentials. Their security model relies on host-based trust: a `.rhosts` or `hosts.equiv` file on the server controls which hosts and users are trusted to connect without a password. Any open r-service port on a modern system is a misconfiguration finding. Confirmed trust-based access is a critical finding: it means unauthenticated remote command execution.

- Confirm Which Services Are Exposed
- rsh: Trust-Based Command Execution Check
- rlogin: Interactive Shell Check
- Force Privileged Source Port with socat
- rexec: Credential-Based Check

## Confirm Which Services Are Exposed

```bash
nmap -sV -p 512,513,514 $TARGET_IP
# 512/tcp open  exec    netkit-rsh rexecd
# 513/tcp open  login   OpenBSD or Solaris rlogind
# 514/tcp open  shell   Netkit rshd
```

Port 514 is rsh (shell), port 513 is rlogin (login), port 512 is rexec (exec). Any of these open on a non-legacy system is immediately suspicious: they have no business being enabled on anything post-2000.

## rsh: Trust-Based Command Execution Check

rsh sends the local username as the client identity. The daemon checks `.rhosts` and `hosts.equiv` to decide whether to trust it. Run with sudo so the client uses a privileged source port, which is required by most rsh daemons:

```bash
sudo rsh -l root $TARGET_IP id
# uid=0(root) gid=0(root) groups=0(root)
```

```bash
sudo rsh -l $USER $TARGET_IP id
# uid=1000(user) gid=1000(user) groups=1000(user)
```

Command output without a password prompt confirms trust-based rsh access. The username in the response tells you which account you have. Try root first, then common usernames. A `Permission denied` response means the account is not in the trust file. An immediate disconnect without any error message usually means the source port enforcement failed: run with sudo.

## rlogin: Interactive Shell Check

rlogin is the interactive equivalent. A shell landing without a password prompt is a direct critical finding:

```bash
sudo rlogin -l root $TARGET_IP
# Last login: Mon Mar 28 12:00:00 2026
# root@target:~#
```

```bash
sudo rlogin -l $USER $TARGET_IP
```

A shell prompt without a password means trust-based authentication succeeded. If prompted for a password, authentication is required: return here with credentials found elsewhere. Note whether different usernames produce different behaviors, as this reveals which accounts exist in the trust configuration.

## Force Privileged Source Port with socat

When rsh or rlogin clients are unavailable, simulate the privileged source port requirement manually:

```bash
sudo socat - TCP:$TARGET_IP:514,sourceport=1023
```

```bash
sudo socat - TCP:$TARGET_IP:513,sourceport=1023
```

Different behavior with a privileged source port versus a non-privileged one confirms the daemon enforces the classic trust model. Install the r-services client package if not present:

```bash
apt-get install -y rsh-client 2>/dev/null || apt-get install -y rsh-redone-client 2>/dev/null
```

## rexec: Credential-Based Check

rexec (port 512) uses explicit username and password rather than host trust. Confirm the port is listening and test with any credentials found from other sources:

```bash
nc -nv $TARGET_IP 512
# Connection to 10.10.10.50 512 port [tcp/exec] succeeded!
```

A successful connection to port 512 confirms rexec is running. The rexec protocol expects a null-separated username, password, and command. Return here once credentials are available from other enumeration. Move to [trust misconfiguration assessment](https://hackindex.io/services/r-services/vulnerability-discovery/r-services-trust-misconfiguration) to understand the .rhosts and hosts.equiv configuration, and to [r-services exploitation](https://hackindex.io/services/r-services/exploitation/r-services-exploitation) for shell access.

## References

- [rsh-client](https://www.kali.org/tools/rsh-client/) - rsh and rlogin client package for Kali