Shell protocols

The Berkeley r-commands, rsh (514), rlogin (513), and rexec (512), provide remote shell, login, and command execution with no encryption and a host-based trust model. Their weaknesses are the .rhosts and hosts.equiv trust that authenticates by source address (spoofable), cleartext credentials and sessions, and command execution through trusted-host relationships.

1 phút đọccập nhật 7 thg 10, 2026florianamette1 người đóng góp
Hỏi trợ lý của bạn (MCP)Sửa trên GitHub

The Berkeley r-commands are a family of legacy Unix remote-access services: rsh (remote shell, TCP 514), rlogin (remote login, TCP 513), and rexec (remote execution, TCP 512). They predate SSH and provide no transport encryption, so credentials, commands, output, and interactive sessions exposed by each protocol travel in cleartext. Their authentication models differ: rsh and rlogin can use ~/.rhosts and /etc/hosts.equiv to grant passwordless access based on the client's host and username, whereas rexec sends a username and password with the request. The attack surface therefore includes host-trust abuse against rsh and rlogin, traffic interception across all three services, and service-specific execution paths.

bash
nmap -p512,513,514 -sV <target>                # rexec, rlogin, rsh
# the services are often found together on legacy Unix

Subtopics#

  • rsh: remote shell on 514 and its trust abuse.
  • rlogin: remote login on 513.
  • rexec: remote execution on 512.
  • Trust abuse: .rhosts and hosts.equiv exploitation against rsh and rlogin.
  • Traffic interception: cleartext capture and live-session hijacking.

References#

TrướcAgent hijackingTiếp Traffic interception