Traditional rshd does not decide trust from the source IP alone. It expects the client to use a privileged source port, may validate the source address through hostname resolution, retrieves both remote and local usernames, and checks the resulting identity against .rhosts or hosts.equiv. An attacker must satisfy that complete decision while impersonating a trusted endpoint. An on-path position provides visibility into the TCP exchange; blind spoofing additionally requires predicting TCP sequence state and forging the handshake and null-terminated rsh protocol fields without seeing replies.
# determine the trusted host, remote user, requested local account, source-port
# requirement, hostname checks, and exact trust rule used by the target
# on-path: intercept or forge a protocol-correct exchange while observing TCP state
# blind: predict TCP state and inject the complete null-terminated rsh request fields
# a successful request might plant .rhosts to convert temporary access into persistence
Exploitation notes#
- The goal is usually not a live session (hard when blind) but injecting one command that establishes durable trust, classically
echo "+ +" >> ~/.rhostsfor the target user, after which the attacker connects normally. - An on-path position exposes TCP state, but the attacker must still satisfy the privileged-port, hostname, user, target-account, and trust-rule checks. Blind spoofing additionally depends on predictable TCP sequence numbers, which modern stacks randomise, so it is mainly viable against old systems.
- The attack may need no password or prior file write, but it does require a matching trusted host/user identity and a protocol-correct connection.
- Combine with knowledge of which hosts are trusted (from a readable hosts.equiv or
.rhosts) to pick a spoofable trusted address.