search
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter

Rusersd Service - Port 1026

hashtag
Basic info

The rusersd daemon, part of the legacy r-services suite, exposes information about logged-in users across networked UNIX systems. While originally designed for convenience in multi-user environments, rusersd can be leveraged by attackers to enumerate active users, session times, and even network structures. This information provides valuable intelligence during pre-exploitation and lateral movement phases of an attack.

hashtag
Understanding rusersd and Its Underlying Protocol

The rusers service relies on RPC (Remote Procedure Call) via portmapper (rpcbind) and operates over UDP/TCP port 873 (commonly UDP). It retrieves user session data from remote machines running the rusersd daemon.

Key service attributes:

  • Communicates via SunRPC protocol.

  • Requires rpcbind to resolve service ports.

  • Does not require authentication by default.

  • Can be queried using standard tools like rpcinfo, rusers, or showmount.

hashtag
Enumerating rusersd for Valuable Information

hashtag
Discovering RPC Services

Use rpcinfo to list available RPC services and determine if rusersd is running:

Look for a line similar to:

hashtag
Querying Active User Sessions

Once rusersd is confirmed active, query the service directly:

This reveals:

  • Logged-in usernames

  • Terminal IDs

  • Idle time

  • Hostnames or IPs (useful for lateral movement)

hashtag
Manual Queries via rpcclient (Optional)

For deeper probing and scripting:

Note: rpcclient is primarily SMB-related but RPC exploration can be extended using custom SunRPC tools.

hashtag
Leveraging rusersd for Privilege Escalation and Lateral Movement

hashtag
Identifying Valuable User Targets

Active usernames such as root, admin, or system operators provide immediate targets for:

  • Brute-force or password spray attacks

  • SSH key harvesting

  • Privilege escalation via sudo/su or misconfigured cronjobs

hashtag
Mapping Internal Network Topology

Output from rusers includes hostnames or IP addresses of logged-in sessions. These often reveal:

  • Internal IP ranges (e.g., 192.168.1.x)

  • Trust relationships between hosts

  • NFS or rsh dependency paths

hashtag
Timing Attacks Based on Idle Time

The idle time metric can help attackers identify:

  • When administrators are likely offline

  • When services or scripts may activate (e.g., after idle logout)

  • Opportunities to inject payloads unnoticed

circle-check

Learn & practice For the Bug Bountyarrow-up-right

chevron-rightSupport VeryLazyTech 🎉hashtag
PreviousRsync - Port 873NextSocks - Port 1080

Last updated