rlogin opens an interactive login session on a remote host via rlogind on TCP 513. Traditional implementations require the client connection to originate from a privileged port in the 512–1023 range, then evaluate host-based trust through ~/.rhosts and /etc/hosts.equiv. If automatic authentication fails, rlogind may invoke the configured login program over the same unencrypted terminal stream; whether that flow requests a password, uses another PAM mechanism, or rejects access depends on the target. The attacks follow: passwordless login by abusing or planting trust, capture of credentials and session data when an unencrypted login flow is used, implementation-dependent username enumeration, and hijacking the live TCP session. Because it grants an interactive shell, a successful rlogin is a direct foothold.
# trusted login (no password) or password login
rlogin -l <user> <target>
nmap -p513 -sV <target>
Subtopics#
- rhosts bypass: passwordless login via host trust.
- Cleartext passwords: capturing the password when trust is not used.
- Username enumeration: discovering valid users from login behaviour.
- Session hijacking: taking over the live rlogin session.