R SERVICES (512, 513 & 514)

TCP ports 512, 513, and 514 are known as “r” services, and can be misconfigured in a way that allows remote access from any host (a standard “.rhosts + +” situation). If you are prompted for an SSH key, this means the rsh-client tools have not been installed and Ubuntu is defaulting to using SSH.

# rlogin -l root 10.10.10.10

RLOGIN (513)

• Rlogin Enumeration
  • Find the files
    • find / -name .rhosts
    • locate .rhosts
  • Examine Files
    • cat .rhosts
  • Manual Login
    • rlogin hostname -l username
    • rlogin <IP>
  • Subvert the files
    • echo ++ > .rhosts
• Rlogin Brute force
  • Hydra