> For the complete documentation index, see [llms.txt](https://thescriptkid.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thescriptkid.gitbook.io/notes/credential-less-enumeration/r-services.md).

# R-Services

## Frequently Abused Commands

<table data-full-width="true"><thead><tr><th width="127">Command</th><th width="156">Service Daemon</th><th width="65">Port</th><th width="107">TCP/UDP</th><th>Description</th></tr></thead><tbody><tr><td><code>rcp</code></td><td><code>rshd</code></td><td>514</td><td>TCP</td><td>Copy a file or directory bidirectionally from the local system to the remote system (or vice versa) or from one remote system to another. It works like the <code>cp</code> command on Linux but provides <code>no warning to the user for overwriting existing files on a system</code>.</td></tr><tr><td><code>rsh</code></td><td><code>rshd</code></td><td>514</td><td>TCP</td><td>Opens a shell on a remote machine without a login procedure. Relies upon the trusted entries in the <code>/etc/hosts.equiv</code> and <code>.rhosts</code> files for validation.</td></tr><tr><td><code>rexec</code></td><td><code>rexecd</code></td><td>512</td><td>TCP</td><td>Enables a user to run shell commands on a remote machine. Requires authentication through the use of a <code>username</code> and <code>password</code> through an unencrypted network socket. Authentication is overridden by the trusted entries in the <code>/etc/hosts.equiv</code> and <code>.rhosts</code> files.</td></tr><tr><td><code>rlogin</code></td><td><code>rlogind</code></td><td>513</td><td>TCP</td><td>Enables a user to log in to a remote host over the network. It works similarly to <code>telnet</code> but can only connect to Unix-like hosts. Authentication is overridden by the trusted entries in the <code>/etc/hosts.equiv</code> and <code>.rhosts</code> files.</td></tr></tbody></table>

## Trusted Hosts File

### /etc/hosts.equiv

<figure><img src="/files/DkiuiKKFhT6bgYZd1mwi" alt=""><figcaption><p>The /etc/hosts.equiv file contains a list of trusted hosts and is used to grant access to other systems on the network. When users on one of these hosts attempt to access the system, they are automatically granted access without further authentication.</p></figcaption></figure>

### .rhosts

<figure><img src="/files/BVrKhC29FePXmhz1h0rO" alt=""><figcaption><p>The .rhosts file contains a list of trusted hosts and is used to grant access to other systems on the network. When users on one of these hosts attempt to access the system, they are automatically granted access without further authentication.</p></figcaption></figure>

> <mark style="color:red;">Note: The</mark> <mark style="color:red;"></mark><mark style="color:red;">`hosts.equiv`</mark> <mark style="color:red;"></mark><mark style="color:red;">file is recognized as the global configuration regarding all users on a system, whereas</mark> <mark style="color:red;"></mark><mark style="color:red;">`.rhosts`</mark> <mark style="color:red;"></mark><mark style="color:red;">provides a per-user configuration.</mark>

## Scanning for R-Services

```
sudo nmap -sV -p 512,513,514 10.0.17.2
```

<figure><img src="/files/tgz7AdJT3DdHRF7E2mYj" alt=""><figcaption></figcaption></figure>

## Logging in Using Rlogin

{% code overflow="wrap" %}

```
rlogin 10.0.17.2 -l htb-student
```

{% endcode %}

<figure><img src="/files/CcEADGG5uAfxI6ar1wQX" alt=""><figcaption></figcaption></figure>

## Listing Authenticated Users Using Rwho

```
rwho
```

<figure><img src="/files/rn8JceLbFqNrIW3JhGMi" alt=""><figcaption></figcaption></figure>

## Listing Authenticated Users Using Rusers

{% code overflow="wrap" %}

```
rusers -al 10.0.17.5
```

{% endcode %}

<figure><img src="/files/xUwa3sEQ0uz68E5yyfgB" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://thescriptkid.gitbook.io/notes/credential-less-enumeration/r-services.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.