rsh authentication failure

farhadka · 02-15-2022, 01:06 AM

hi
I'm trying Mitnick attack for a lab with docker, in terminal container I made .rhosts file and wrote the trusted server's ip in it (echo 10.9.0.6 > .rhosts) and also made it writable only for owner (chmod 644 .rhosts) but when I use "rsh 10.9.0.5(terminal's ip) date" in the server, I see authentication error, what should I do and how can I fix this?

ondoho · 02-15-2022, 01:36 AM

Quote:

Originally Posted by farhadka

hi
I'm trying Mitnick attack for a lab with docker, in terminal container I made .rhosts file and wrote the trusted server's ip in it (echo 10.9.0.6 > .rhosts) and also made it writable only for owner (chmod 644 .rhosts) but when I use "rsh 10.9.0.5(terminal's ip) date" in the server, I see authentication error, what should I do and how can I fix this?

I was curious, seems to be this: https://seedsecuritylabs.org/Labs_16...ick_Attack.pdf
We really need morte information on this. No modern Linux system will allow you to access it remotely just like that, and rsh is outdated, apparently you have to jump through hoops to even get it on your system.

farhadka · 02-15-2022, 01:56 AM

Quote:

Originally Posted by ondoho

I was curious, seems to be this: https://seedsecuritylabs.org/Labs_16...ick_Attack.pdf
We really need morte information on this. No modern Linux system will allow you to access it remotely just like that, and rsh is outdated, apparently you have to jump through hoops to even get it on your system.

yeah that's true
I've installed rsh-redone that re-implements remote shell (as its mentioned in that file), but I dont know why I see that error and how should I fix it

ondoho · 02-15-2022, 02:22 AM

Which distro etc.
This still isn't enough information.
Please don't make us ask for every little bit separately.

farhadka · 02-15-2022, 04:39 AM

Quote:

Originally Posted by ondoho

Which distro etc.
This still isn't enough information.
Please don't make us ask for every little bit separately.

I'm so sorry I didn't know what information you are asking
Distributor ID: Ubuntu
Description: Ubuntu 20.04.1 LTS
Release: 20.04
Codename: focal
Docker version 19.03.8
docker-compose version 1.27.4, build 40524192
docker-py version: 4.3.1
CPython version: 3.7.7
OpenSSL version: OpenSSL 1.1.0l 10 Sep 2019
rsh-redone-server/client 85-2build1

ondoho · 02-16-2022, 01:14 AM

Good, thanks.
Correct me if I'm wrong but it would seem that we need precisely that info for both systems involved?

What is the exact command, what is the full output? Please use CODE tags for that (see my signature).
If rsh has a verbose option, please use that ("man rsh").

farhadka · 02-16-2022, 03:13 AM

Quote:

Originally Posted by ondoho

Good, thanks.
Correct me if I'm wrong but it would seem that we need precisely that info for both systems involved?

What is the exact command, what is the full output? Please use CODE tags for that (see my signature).
If rsh has a verbose option, please use that ("man rsh").

no there is not another system, just one, and im using containers for the lab, one for attacker,one for terminal and one for trusted server
first i use this code:

Code:

$ docker-compose build
x-terminal uses an image, skipping
trusted-server uses an image, skipping
Building attacker
Step 1/3 : FROM handsonsecurity/seed-ubuntu:large
 ---> cecb04fbf1dd
Step 2/3 : ARG DEBIAN_FRONTEND=noninteractive
 ---> Using cache
 ---> 0b46b3129601
Step 3/3 : RUN apt-get update     && apt-get -y install           rsh-redone-client           rsh-redone-server     && rm -rf /var/lib/apt/lists/*
 ---> Using cache
 ---> 871d73ab78dd

Successfully built 871d73ab78dd
Successfully tagged seed-image-ubuntu-mitnick:latest

and then:

Code:

$ docker-compose up
Creating network "net-10.9.0.0" with the default driver
Creating seed-attacker           ... done
Creating trusted-server-10.9.0.6 ... done
Creating x-terminal-10.9.0.5     ... done
Attaching to seed-attacker, x-terminal-10.9.0.5, trusted-server-10.9.0.6
x-terminal-10.9.0.5 |  * Starting internet superserver inetd             [ OK ]

then in the root in new terminal:

Code:

$ dockps
493e2cace4de  trusted-server-10.9.0.6
776e3afbdfc1  x-terminal-10.9.0.5
2aec5def0191  seed-attacker

then i open terminal container:

Code:

$ docksh 77
root@776e3afbdfc1:/# touch .rhosts
root@776e3afbdfc1:/# echo 10.9.0.6 > .rhosts
root@776e3afbdfc1:/# chmod 644 .rhosts
root@776e3afbdfc1:/# exit

finally for trusted server:

Code:

$ docksh 49
root@493e2cace4de:/# rsh 10.9.0.5 date
Authentication failure

redteamlegion · 01-27-2024, 08:35 AM

use su seed and then try, it will print date on screen, only seed user allowed to log into the xterminal.

jayjwa · 01-29-2024, 10:44 AM

AFAIK, .rhosts is set up like

Code:

example.org   auser

and not just IP like you have it. The above will allow auser@example.org in. Furthermore, the username and incoming hostname need to be as the remote machine will see it which matters on a multi-homed host. I have my .rhosts 0600. Obviously you need the remote server running rshd, listening, and not firewalled. I don't know about Docker or rsh-redone (inetutils rsh still works).

Code:

jayjwa@atr2 ~> rsh -4 lunast show status

  Status on  29-JAN-2024 10:49:32.36     Elapsed CPU :   0 00:00:00.12
  Buff. I/O :       28    Cur. ws. :     611    Open files :         2
  Dir. I/O :         8    Phys. Mem. :   392    Page Faults :      425