If automatic host-trust authentication fails, traditional rlogind invokes the configured login program over its unencrypted pseudo-terminal. The resulting authentication flow is implementation- and policy-dependent: it may request a password, use another PAM mechanism, or reject access. When a password is requested, an attacker on the path can capture the username and password from the stream, along with the interactive session that follows. Passive capture avoids failed guesses and lockouts, but the credential's validity and reuse remain limited by the target's account policy.
# capture the cleartext rlogin login and session
tcpdump -i eth0 -w rlogin.pcap port 513
tshark -r rlogin.pcap -q -z follow,tcp,ascii,0 # reassemble login + session
Exploitation notes#
- Capture beats guessing: a sniffed rlogin login yields the exact credential quietly, so prefer it wherever an on-path position exists, the same reasoning as Telnet password sniffing.
- The whole session is captured too, exposing commands, output, and any secondary credentials entered, see command/session capture.
- The credential may be reused elsewhere only if accounts or passwords are shared; assess that possibility solely within the authorized scope rather than assuming reuse.
- Needs an on-path/tap position and a target login flow that actually requests a password; combine with trust abuse depending on the authentication path in use.