Basically tries lots of combinations of local and remote usernames to execute commands via RSH.<\/p>\n
Download<\/a><\/p>\n SHA1sum: f1b37abb6ad54df775c1cf194ab91fd41d607f1f<\/p>\n MD5sum: 2ecae8730f89c697f2512181ded3842f<\/p>\n User documentation is also available in PDF<\/a> format.<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n rsh-grind is a tool for remotely enumerating user accounts that are able to use the Remtoe Shell (RSH) protocol. The RSH protocol requires a local and remote username to be supplied. rsh-grind simply works through all possible combinations of local and remote usernames supplied via a wordlist.<\/p>\n rsh-grind is just a stand alone PERL script, so installation is as simple as copying it to your path (e.g. \/usr\/local\/bin). It has only been tested under Linux so far.<\/p>\n It depends on the following PERL modules which you may need to install them first:<\/p>\n If you have PERL installed, you should be able to install the modules from CPAN:<\/p>\n rsh-grind simply needs to be passed a list of local users, a list of remote users and a list of target RSH servers. Here’s the usage message:<\/p>\n For the examples below we need a list of potential usernames. The following output demostrates the format for this list:<\/p>\n If we assume that users of the RSH protocol will use the same username locally (i.e. where the rsh client is run) and remotely (i.e. on the server which we’re testing), we only need a single list of usernames.<\/p>\n Note that we have to run as root because the RSH protocol requires us to bind to ports below 1024.<\/p>\n The results show 4 pairs of local and remote users that can execute commands via RSH. This usually indicates that user have an entry like the following in their\u00a0\/.rhosts file:<\/p>\n The + here means that access is allowed from any source IP address.<\/p>\n However, in this case the results are caused by the host running rsh-grind being present in \/etc\/hosts.equiv (not very likely in the real world, but it demonstrates what results you’d get with the small list of usernames above).<\/p>\n The remote username is sometimes different to the local username, e.g. a user fred might have the following in\u00a0fred\/.rhosts:<\/p>\n This means that the remote user fbloggs would be allowed to access fred’s account from any source IP address.<\/p>\n We simply supply two lists of usernames (often, but not necessarily the same list):<\/p>\n This tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then do not use this tool.<\/p>\n In all other respects the GPL version 2 applies:<\/p>\n Basically tries lots of combinations of local and remote usernames to execute commands via RSH. Download SHA1sum: f1b37abb6ad54df775c1cf194ab91fd41d607f1f MD5sum: 2ecae8730f89c697f2512181ded3842f User documentation is also available in PDF format.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16],"tags":[19,119,42],"_links":{"self":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/115"}],"collection":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/comments?post=115"}],"version-history":[{"count":5,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/115\/revisions"}],"predecessor-version":[{"id":582,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/115\/revisions\/582"}],"wp:attachment":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/media?parent=115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/categories?post=115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/tags?post=115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}rsh-grind User Documentation<\/h1>\n
<\/a> Contents<\/h2>\n
\n
\n
<\/a>Overview<\/h1>\n
<\/a>Installation<\/h1>\n
\n
# perl -MCPAN -e shell\r\n cpan> install Getopt::Std<\/pre>\n
<\/a>Usage<\/h1>\n
Usage: rsh-grind.pl [options] ( -U username_file ) ( -f ips.txt | hostname )\r\n rsh-grind.pl [options] (-l local_user|-L file) | (-r remote_user|-R file) (-f ips.txt|host) \r\n\r\n options are:\r\n -m n Maximum number of processes (default: 10)\r\n -l Local username (on the client)\r\n -L file File of local usernames\r\n -r Remote username (on the server)\r\n -R file File or remote usernames\r\n -U file File of usernames. Each will be used as remote and local\r\n user (e.g. root\/root, smtp\/smtp). Permutations will not\r\n be tried.\r\n -c cmd Command to execute (default: id)\r\n (Must be non-interactive, so don't try \/bin\/sh for example)\r\n -f file File of target hostnames \/ IPs\r\n -t n Wait a maximum of n seconds for reply (default: 5)\r\n -d Debugging output\r\n -v Verbose\r\n -h This help message \r\n\r\n The Remote Shell Protocol (RSH) allows remote users to execute commands\r\n on the server. Authentication is based on:\r\n - Source IP Address\r\n - Remote Username\r\n - Local Username \r\n\r\n This script can't help you with obtaining a valid source IP address, but\r\n it can help you try different combinations of remote and local usernames. \r\n\r\n If your source IP address is in \/etc\/hosts.equiv, then you just need a\r\n valid username on the system, the remote and local usernames should be the\r\n same. \r\n\r\n If the remote user account you're attacking has a .rhosts file like the\r\n following in their home directory, it doesn't matter what the local\r\n username is:\r\n IP + \r\n\r\n In both of the above cases, the most efficient usage is: \r\n\r\n $ rsh-grind.pl -U users.txt target \r\n\r\n If the .rhosts looks like the following, though the local username must\r\n be \"foo\":\r\n IP foo \r\n\r\n In this case you might need to try lots of permutations before you\r\n hit on the one that works. The correct usage is: \r\n\r\n $ rsh-grind.pl -L localusers.txt -R remoteusers.txt target \r\n\r\n Output lines will be something like:\r\n 10.0.0.1\/localuser\/remoteuser _uid=101(remoteuser) gid=1(other)_ \r\n\r\n Non-printable characters are sqashed to _ to fit whole response on\r\n one line. \r\n\r\n NB: The RSH protocol requires the binding of a local privileged port, so\r\n you need to run this script as root.<\/pre>\n
<\/a>Some Examples<\/h1>\n
$ head users.txt\r\n root\r\n bin\r\n daemon\r\n adm\r\n lp\r\n sync\r\n shutdown\r\n halt\r\n mail\r\n news<\/pre>\n
<\/a> Assuming Remote Usernames are Same as Local Usernames<\/h2>\n
$ sudo rsh-grind.pl -U users.txt 172.16.16.7\r\n Starting rsh-grind v0.9.2 ( http:\/\/pentestmonkey.net\/tools\/rsh-grind ) \r\n\r\n ----------------------------------------------------------\r\n | Scan Information |\r\n ---------------------------------------------------------- \r\n\r\n Processes .............. 10\r\n Command ................ id\r\n Target ................. 172.16.16.7\r\n Usernames file ......... users.txt\r\n Username count ......... 10\r\n Query timeout .......... 5 secs \r\n\r\n ######## Scan started at Sun May 6 18:39:13 2007 #########\r\n 172.16.16.7\/bin\/bin _uid=2(bin) gid=2(bin)_\r\n 172.16.16.7\/daemon\/daemon _uid=1(daemon) gid=1(other)_\r\n 172.16.16.7\/lp\/lp _uid=71(lp) gid=8(lp)_\r\n 172.16.16.7\/adm\/adm _uid=4(adm) gid=4(adm)_\r\n ######## Scan completed at Sun May 6 18:39:14 2007 #########\r\n 4 results. \r\n\r\n 10 queries in 1 seconds (10.0 queries \/ sec)<\/pre>\n
+ myuser<\/pre>\n
<\/a> What if the Local and Remote Usernames are Different?<\/h2>\n
+ fbloggs<\/pre>\n
$ sudo .\/rsh-grind.pl -L localusers.txt -R remoteusers.txt 172.16.16.7\r\n Starting rsh-grind v0.9.2 ( http:\/\/pentestmonkey.net\/tools\/rsh-grind ) \r\n\r\n ----------------------------------------------------------\r\n | Scan Information |\r\n ---------------------------------------------------------- \r\n\r\n Processes .............. 10\r\n Command ................ id\r\n Target ................. 172.16.16.7\r\n Remote usernames file .. localusers.txt\r\n Local usernames file ... remoteusers.txt\r\n Remote username count .. 12\r\n Local username count ... 12\r\n Query timeout .......... 5 secs \r\n\r\n ######## Scan started at Sun May 6 18:58:03 2007 #########\r\n 172.16.16.7\/fred\/fbloggs _uid=102(fred) gid=1(group)_\r\n ######## Scan completed at Sun May 6 18:58:09 2007 #########\r\n 0 results. \r\n\r\n 144 queries in 6 seconds (24.0 queries \/ sec)<\/pre>\n
<\/a>License<\/h1>\n
This program is free software; you can redistribute it and\/or modify\r\n it under the terms of the GNU General Public License version 2 as\r\n published by the Free Software Foundation. \r\n\r\n This program is distributed in the hope that it will be useful,\r\n but WITHOUT ANY WARRANTY; without even the implied warranty of\r\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\r\n GNU General Public License for more details. \r\n\r\n You should have received a copy of the GNU General Public License along\r\n with this program; if not, write to the Free Software Foundation, Inc.,\r\n 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.<\/pre>\n","protected":false},"excerpt":{"rendered":"