DΛΣMӨП

// HackTricks · Network Services

1026 - Pentesting Rusersd

1026 - Pentesting Rusersd

Basic Information

rusersd is a legacy SunRPC/ONC RPC service that answers rusers queries and returns who-style information about users currently logged in to the target. In long format this can reveal the username, hostname, TTY, login time, idle time, and sometimes the remote host the session came from, which is enough to identify real usernames, active sessions, and interesting pivot hosts.[1]

Although this page is named after port 1026, rusersd is usually not a fixed 1026/tcp or 1026/udp service. In practice it is normally discovered through rpcbind/portmapper as RPC program 100002, often exposing versions 2 and 3 over UDP and sometimes TCP on dynamically assigned high ports.[2]

If you haven’t mapped the RPC programs yet, start with Pentesting Portmapper / RPCBind.

1026 - Pentesting Rusersd: This protocol will provide you the usernames of the host. You may be able to find this services listed by the port-mapper service like this

Enumeration

Discover it behind rpcbind

rpcinfo -p <target> | grep -i rusersd
# or
nmap -sV -p 111 --script rpcinfo <target>

The interesting part of the output is the RPC program number, supported versions, transport, and the real high port assigned by rpcbind.[2]

100002  2,3  32776/udp  rusersd
100002  2,3  32780/tcp  rusersd

Query a single host

apt-get install rusers
rusers -l <target>
rusers -al <target>

-l requests the long listing, which is the most useful mode during a pentest because it exposes the TTY, login timestamp, idle time, and remote origin host when available. -a is useful when you want to confirm that the daemon responds even if nobody is currently logged in.[1]

Example:

root@kali:~# rusers -l 192.168.10.1
Sending broadcast for rusersd protocol version 3...
Sending broadcast for rusersd protocol version 2...
tiff       potatohead:console         Sep  2 13:03   22:03
katykat    potatohead:ttyp5           Sep  1 09:35      14

Broadcast the local segment

If no host is specified, rusers queries the local network and waits briefly for late responses, which makes it useful for quickly identifying legacy UNIX hosts on the same broadcast domain.[1]

rusers -a
rusers -al
rusers -h
rusers -il

Useful flags:[1]

  • -a: Print hosts that answer even when no one is logged in.
  • -h: Sort results by hostname.
  • -i: Sort by idle time to quickly spot active sessions.
  • -l: Print the long who-style listing.

Offensive use of the output

Treat rusersd as a username and session-intelligence leak, not just as a banner grab. Low-idle sessions often point to real operators or admins currently working on the system, while the optional remote-host field can reveal jump boxes, trusted workstations, or naming conventions worth reusing against SSH, NFS, NIS/YP, or other legacy RPC services on the same environment.[1]

References