514 - Pentesting Rsh
Basic Information
The remote shell service (rsh) historically used /etc/hosts.equiv and per-user .rhosts files to trust remote hosts and users. This host-based model depends on IP-address and Domain Name System (DNS) assumptions and is vulnerable to address or name-resolution spoofing, especially on a local network.[1]
Because .rhosts resides in a user’s home directory, an attacker who can modify that file—for example, through an exposed NFS home directory—may be able to add a trusted host or user.[1]
Default port: 514/TCP
Login
rsh <IP> <Command>
rsh <IP> -l domain\user <Command>
rsh domain/user@<IP> <Command>
rsh domain\\user@<IP> <Command>