Intrusionz3r0
HacktheboxTwitter
  • Welcome
  • Windows Penetration Testing
    • Enumeration
    • Credentials Attacks On Windows
    • Kerberos
    • Abuse ACLS
    • Common Attacks
    • Abuse Tokens
    • Kerberos “Double Hop”
    • Privileged Groups
    • Defense Evasion
    • Active Directory Certificate Services
    • Windows Persistence
    • Privilege Escalation
    • Trust Enumeration and Attacks
    • Windows Lateral Movement
    • Powershell Cheetsheet
    • Microsoft Exchange and Office
  • Linux Penetration Testing
    • Linux Active directory
    • Tools
    • Privilege Groups
    • Post Exploitation
    • Privilege Escalation
      • Sudo Privilege escalation
      • Writable .service files
      • Wildcard on compression binaries
      • Path Abuse
      • Capabilities
      • Exploit Logrotate
      • Weak NFS Privileges
      • Hijacking Tmux Sessions
      • Shared Libraries
      • Shared Object Hijacking
      • Python Library Hijacking
      • Linux Enumeration
    • Stealing Linux Credentials
    • Critical Vulnerabilities
    • Upgrading TTY
    • Process monitoring
    • Miscellaneous
    • Escape Restricted Shell
  • Malware Development
    • Malware Development Essentials
    • Code Snippets
    • Malware Development Intermediate
  • Social Engineering
  • Portforwarding and tunneling
  • File Transfer Techniques
  • Password Attacks
  • Enumeration
    • Network Enumeration
    • (OSINT) Active Enumeration
    • (OSINT) Passive Enumeration
    • [22] SSH
    • [21] FTP
    • [25,465,587] SMTP
    • [53] DNS Enumeration
    • [80 443] HTTP HTTPS
    • [110,143,993,995] IMAP/POP3 Enumeration
    • [111,2049] Network File System
    • [139,445] SMB Enumeration
    • [161] SNMP
    • [512,513,514] R-Services
    • [623] IPMI
    • [873] Rsync
    • [1433] MSSQL
    • [1521] Oracle TNS
    • [3389] Remote Desktop Protocol (RDP)
    • [5985/5986] WinRM
    • [3306] Mysql
    • [513] Rlogin
  • Hacking Web
    • Methodology
    • Vulnerabilities
      • SQL Injection
      • Cross Site Scripting (XSS)
      • File path traversal/Local File Inclusion
      • File Upload Attacks
      • Denial of Service
      • Command Injection
      • Insecure Direct Object Reference (IDOR)
      • XML External Entity (XXE) Injection
      • Web Mass Assignment Vulnerabilities
      • Log4Shell Exploitation Guide
      • Authentication
      • Business Vulnerabilities
      • Access control vulnerabilities
      • Server-Side Request Forgery (SSRF)
      • Cross-site request forgery (CSRF)
      • Cross-origin resource sharing (CORS)
      • Clickjacking
      • DOM-based vulnerabilities
      • JWT vulnerabilities
      • Password reset poisoning
    • Web Tech Detection viaa Tokens, Headers & Cookies
    • Burpsuite through SOCKS5
    • Bypass 403 - Forbidden
  • OSINT
  • Common Applications
    • Gitlab
    • Splunk
    • Tomcat
    • Joomla
    • Microsoft Internet Information Services (IIS)
    • Nagios XI
    • Wordpress
    • Drupal
    • Tomcat CGI
    • osTicket
    • Attacking Thick Client Applications
    • PRTG Network Monitor
    • Jenkins
    • ColdFusion
    • WebLogic
    • Grafana
    • Umbraco
  • Containers Pentesting
  • C2 Command and Control
    • Sliver
    • Cobalt Strike
    • Mythic
    • Havoc
  • Report Templates
  • Anonymity Guide
  • Labs
    • Vulnlabs
      • Baby
      • Trusted (Chain)
      • Retro
      • Retro2
      • Hybrid (Chain)
      • Baby2
      • Breach
      • Sendai
      • Sweep
      • Delegate
      • Redelegate
      • Media
      • Bruno
      • Cicada
      • Lustrous2
      • Tengu (Chain)
      • Reflection (Chain)
      • Tea (Chain)
      • Heron (Chain)
      • Lustrous (Chain)
      • Kaiju (Chain)
      • Intercept (Chain)
      • Sidecar (Chain)
      • Vigilant (Chain)
      • Job
      • Job2
      • Puppet (Chain)
      • Mythical (Chain)
      • Push (Chain)
Powered by GitBook
On this page
  1. Enumeration

[512,513,514] R-Services


#Footprinting
Intrusionz3r0X@htb[/htb]$ sudo nmap -sV -p 512,513,514 10.0.17.2
# Log in using rlogin
Intrusionz3r0X@htb[/htb]$ rlogin 10.0.17.2 -l htb-student

#List autghenticated users
Intrusionz3r0X@htb[/htb]$ rwho

Intrusionz3r0X@htb[/htb]$ rusers -al 10.0.17.5

Command

Service Daemon

Port

Transport Protocol

Description

rcp

rshd

514

TCP

Copy a file or directory bidirectionally from the local system to the remote system (or vice versa) or from one remote system to another. It works like the cp command on Linux but provides no warning to the user for overwriting existing files on a system.

rsh

rshd

514

TCP

Opens a shell on a remote machine without a login procedure. Relies upon the trusted entries in the /etc/hosts.equiv and .rhosts files for validation.

rexec

rexecd

512

TCP

Enables a user to run shell commands on a remote machine. Requires authentication through the use of a username and password through an unencrypted network socket. Authentication is overridden by the trusted entries in the /etc/hosts.equiv and .rhosts files.

rlogin

rlogind

513

TCP

Enables a user to log in to a remote host over the network. It works similarly to telnet but can only connect to Unix-like hosts. Authentication is overridden by the trusted entries in the /etc/hosts.equiv and .rhosts files.

Previous[161] SNMPNext[623] IPMI