512 / 513 - REXEC / RLOGIN
The rexec and rlogin services are design to allow users of a network to execute commands remotely. However, those services do not provide any good means of authentication, so they may be abused to leverage an unauthenticated RCE.
Network scan
Nmap can be used to scan the network for open rexec and rlogin services:
Auth bruteforce
The nmap NSE scripts rexec-brute.nse and rlogin-brute.nse can be used to brute force the services, as well as the metasploit modules auxiliary/scanner/rservices/rexec_login and auxiliary/scanner/rservices/rlogin_login. If all tested credentials are returned as valid ("Valid credentials"), the services are vulnerable to unauthenticated access.
CLI access
The rlogin CLI tool can be used to access a system:
Last updated