rsh runs a command (or an interactive shell) on a remote host via rshd on TCP 514. Traditional implementations first require a client source port in the privileged 512–1023 range, may verify that reverse and forward hostname resolution agree, retrieve the remote username, requested local account, and command, and then evaluate ~/.rhosts or /etc/hosts.equiv through ruserok. A matching trust rule grants access without a password. An attacker who satisfies that complete protocol and trust decision—by controlling a trusted identity, planting an acceptable .rhosts, abusing a permissive hosts.equiv, or performing a protocol-correct spoofing attack—can run commands as the target user. The resulting streams are unencrypted and therefore interceptable.
# if trusted (or trust is permissive), run commands with no password
rsh -l <user> <target> id
rsh -l root <target> 'cat /etc/shadow'
# test reachability
nmap -p514 -sV <target>
Subtopics#
- rhosts bypass: passwordless access via .rhosts trust.
- hosts.equiv: system-wide trust abuse.
- IP spoofing: impersonating a trusted source address.
- Cleartext interception: capturing the unencrypted session.