// HackTricks · Network Services

514 - Pentesting Rsh

514 - Pentesting Rsh

Basic Information

The remote shell service (rsh) historically used /etc/hosts.equiv and per-user .rhosts files to trust remote hosts and users. This host-based model depends on IP-address and Domain Name System (DNS) assumptions and is vulnerable to address or name-resolution spoofing, especially on a local network.[1]

Because .rhosts resides in a user’s home directory, an attacker who can modify that file—for example, through an exposed NFS home directory—may be able to add a trusted host or user.[1]

Default port: 514/TCP

Login

rsh <IP> <Command>
rsh <IP> -l domain\user <Command>
rsh domain/user@<IP> <Command>
rsh domain\\user@<IP> <Command>

Brute Force

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.