Vulnerability Discovery

R-services vulnerability discovery targets the trust relationships that make these protocols inherently insecure. Check .rhosts files in user home directories and /etc/hosts.equiv for overly permissive entries, especially the + wildcard that trusts all hosts. Any entry you can match or spoof is exploitable.

The protocols themselves are the vulnerability: rlogin (port 513), rsh (port 514), and rexec (port 512) transmit all data, including credentials for rexec, in plaintext. Their presence on a network means credential sniffing is trivial with tools like tcpdump or Wireshark.

Scan for these services with Nmap and verify accessibility. Even when trust files are locked down, the unencrypted nature of the protocols makes them a finding in any assessment. Look for systems where r-services run alongside SSH, since the trust files may grant access that SSH configurations would deny.