/etc/hosts.equiv defines system-wide trust for rsh and rlogin, but its breadth depends on the entry. A host-only rule permits remote users to access like-named local accounts without a password. A rule with a username permits that remote user to access non-root local accounts, and wildcard forms such as host + or a bare + are broader still. An attacker can abuse a host they control or can spoof when their username matches the rule, or modify the file after gaining elevated local access. Root is excluded from hosts.equiv processing.
# a host-only entry normally requires like-named remote and local users
rlogin -l <matching-user> <target>
rsh -l <matching-user> <target> id
# a wildcard/permissive hosts.equiv (for example, a bare "+" or "host +") trusts widely
# if writable (post-elevation), grant system-wide trust:
echo '+' >> /etc/hosts.equiv
Exploitation notes#
- A host-only entry is limited to like-named accounts; a username field or wildcard determines whether the same host can reach other non-root accounts.
- A bare
+is the maximal weakness, although modern PAM configurations may require an explicit promiscuous option before treating it as a wildcard. Combined with IP spoofing of a trusted address, a matching rule can grant access without controlling the trusted host. - Writing
hosts.equivneeds elevated local access (it is root-owned), so it is more a persistence/escalation step than an initial vector; the initial vector is usually an already-permissive file plus a trusted or spoofed source. - The same file governs
rshandrlogin, but not password-basedrexec; see the trust-abuse hosts.equiv page for the shared view.