Trusted host bypass

Where rexecd honours the host-based trust files, or where the related rsh path is reachable, an attacker executes commands with no password by connecting from, or spoofing, a trusted host, or by planting a .rhosts entry. This removes the credential requirement entirely, giving command execution as the target user.

1 phút đọccập nhật 7 thg 10, 2026

1 người đóng góp

rexec and the trusted r-commands must not be conflated. rexecd receives a username and password for authentication; it does not consult ~/.rhosts or /etc/hosts.equiv. Those trust files are used by services such as rsh and rlogin. A host may expose both service families, but passwordless execution through rsh is a separate endpoint and does not bypass rexec authentication.

bash

# identify the services independently
nmap -sV -p512,513,514 <target>  # rexec, rlogin, and rsh use separate ports
# rexec still requires its username and password; avoid placing the password in argv
rexec -l <user> <target> id
# only a separately exposed rsh service can use matching host trust
rsh -l <user> <target> id

Exploitation notes#

Confirm each exposed service rather than assuming that a host running rexecd also runs rshd or rlogind.
If rsh or rlogin is independently available, assess its .rhosts and hosts.equiv rules under that service's authentication model.
For rexec itself, the relevant credential risk is cleartext password capture.

Trusted host bypass

Exploitation notes#

References#