rexec executes a command on a remote host via rexecd on TCP 512. It authenticates with a username and password sent in cleartext, so a positioned attacker can capture reusable credentials. Where a server or wrapper constructs the executed command unsafely from attacker-influenced input, command injection can extend what runs. A successful request executes as the authenticated user. Unlike rsh and rlogin, rexec does not authenticate through ~/.rhosts or /etc/hosts.equiv.
# run a command and let the client obtain credentials interactively or from its configured source
# the password is still sent unencrypted; passing it with -p may also expose it in the local process list
rexec -l <user> <target> id
nmap -p512 -sV <target>
Subtopics#
- Cleartext passwords: capturing the rexec credential.
- Trusted-host distinction: why rsh/rlogin host trust is a separate service path, not a rexec bypass.
- Command injection: abusing unsafe command construction.