Rusersd Service - Port 1026
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
The rusersd daemon, part of the legacy r-services suite, exposes information about logged-in users across networked UNIX systems. While originally designed for convenience in multi-user environments, rusersd can be leveraged by attackers to enumerate active users, session times, and even network structures. This information provides valuable intelligence during pre-exploitation and lateral movement phases of an attack.
The rusers service relies on RPC (Remote Procedure Call) via portmapper (rpcbind) and operates over UDP/TCP port 873 (commonly UDP). It retrieves user session data from remote machines running the rusersd daemon.
Key service attributes:
Communicates via SunRPC protocol.
Requires rpcbind to resolve service ports.
Does not require authentication by default.
Can be queried using standard tools like rpcinfo, rusers, or showmount.
Use rpcinfo to list available RPC services and determine if rusersd is running:
Look for a line similar to:
Once rusersd is confirmed active, query the service directly:
This reveals:
Logged-in usernames
Terminal IDs
Idle time
Hostnames or IPs (useful for lateral movement)
rpcclient (Optional)For deeper probing and scripting:
Note: rpcclient is primarily SMB-related but RPC exploration can be extended using custom SunRPC tools.
Active usernames such as root, admin, or system operators provide immediate targets for:
Brute-force or password spray attacks
SSH key harvesting
Privilege escalation via sudo/su or misconfigured cronjobs
Output from rusers includes hostnames or IP addresses of logged-in sessions. These often reveal:
Internal IP ranges (e.g., 192.168.1.x)
Trust relationships between hosts
NFS or rsh dependency paths
The idle time metric can help attackers identify:
When administrators are likely offline
When services or scripts may activate (e.g., after idle logout)
Opportunities to inject payloads unnoticed
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚