id: rlogin-detect

info:
  name: Rlogin Detect
  author: pussycat0x
  severity: info
  description: |
    rlogin was a remote login protocol that allowed users to access UNIX systems over TCP port 513.  It transmitted credentials and session data in plaintext, which made it insecure and obsolete once SSH was introduced.
  reference:
    - https://www.ibm.com/docs/en/aix/7.1.0?topic=r-rlogin-command
  metadata:
    shodan-query: "rlogin"
    verified: true
    max-request: 1
  tags: rlogin,network,js,tcp,discovery

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      let packet = bytes.NewBuffer();
      const c = require("nuclei/net");
      const cmd = "\x00"
      packet.WriteString(cmd)
      let conn = c.Open('tcp', `${Host}:${Port}`);
      conn.SendHex(packet.Hex());
      const result = conn.RecvFullString()
      result

    args:
      Host: "{{Host}}"
      Port: 513

    matchers:
      - type: dsl
        dsl:
          - "success == true"
          - contains(response, "rlogin")
        condition: and
# digest: 4a0a0047304502206da157df0767d7c44129a39db7e5dd834bfb473fa31813e05139d1976b591d4f022100ed92af1ad65c9529f40479c25946c3284677883abaca33395995cdd98125f53a:922c64590222798bb761d5b6d8e72950