My useful stuff for HTB CPTS class

R-Services

R-services span across the ports 512, 513, and 514 and are only accessible through a suite of programs known as r-commands.

The R-commands suite consists of the following programs:

  • rcp (remote copy)
  • rexec (remote execution)
  • rlogin (remote login)
  • rsh (remote shell)
  • rstat
  • ruptime
  • rwho (remote who)
Command Service Daemon Port Transport Protocol Description
rcp rshd 514 TCP Copy a file or directory bidirectionally from the local system to the remote system (or vice versa) or from one remote system to another. It works like the cp command on Linux but provides no warning to the user for overwriting existing files on a system.
rsh rshd 514 TCP Opens a shell on a remote machine without a login procedure. Relies upon the trusted entries in the /etc/hosts.equiv and .rhosts files for validation.
rexec rexecd 512 TCP Enables a user to run shell commands on a remote machine. Requires authentication through the use of a username and password through an unencrypted network socket. Authentication is overridden by the trusted entries in the /etc/hosts.equiv and .rhosts files.
rlogin rlogind 513 TCP Enables a user to log in to a remote host over the network. It works similarly to telnet but can only connect to Unix-like hosts. Authentication is overridden by the trusted entries in the /etc/hosts.equiv and .rhosts files.

/etc/hosts.equiv

cat /etc/hosts.equiv

# <hostname> <local username>
pwnbox cry0l1t3

Scanning for R-Services

sudo nmap -sV -p 512,513,514 10.0.17.2

Starting Nmap 7.80 ( https://nmap.org ) at 2022-12-02 15:02 EST
Nmap scan report for 10.0.17.2
Host is up (0.11s latency).

PORT    STATE SERVICE    VERSION
512/tcp open  exec?
513/tcp open  login?
514/tcp open  tcpwrapped