Exploitation

R-services exploitation abuses the trust model that rlogin, rsh, and rexec rely on. These protocols authenticate based on source hostname and username rather than passwords, so a compromised host listed in .rhosts or /etc/hosts.equiv grants access without credentials. Rlogin gives you an interactive shell, rsh runs single commands remotely, and rexec adds password-based authentication but transmits everything in cleartext.

The attack is straightforward: if .rhosts contains a + wildcard or lists your controlled host, rlogin and rsh accept your connection as the target user. Spoofing the source hostname or IP can bypass restrictions when DNS or ARP are under your control.

Once you have rsh or rlogin access, pivot by checking the target's own .rhosts and hosts.equiv files for further trust chains. Legacy Unix and Linux systems in enterprise environments still run these services more often than administrators realize.