R-SERVICES

RLOGIN

The rlogin is used to login to a remote host. Think of this as similar to telnet

root@oco:~$ rlogin 10.0.17.2 -l htb-student
 Last login: Fri Dec  2 16:11:21 from localhost

[htb-student@localhost ~]$

 * this shows an attacker as successfully logged in under the htb-student account on 
   the remote host due to the misconfigurations in the .rhosts file
    - cat .rhosts
      htb-student     10.0.17.5
      +               10.0.17.10
      +               +
      
       - In this example, the + modifier allows any external user to access 
         r-commands from the htb-student user account via the host with the IP 
         address 10.0.17.10

RWHO

This is used to list authenticated users

root@oco:~$ rwho
 root     web01:pts/0 Dec  2 21:34
 htb-student     workstn01:tty1  Dec  2 19:57  2:25
 
 * the htb-student user is currently authenticated to the workstn01 host, whereas 
   the root user is authenticated to the web01 host

RUSERS

This displays a more detailed account of all logged-in users over the network, including information such as the username, hostname of the accessed machine, TTY that the user is logged into, the date and time the user logged in, the amount of time since the user typed on the keyboard, and the remote host they logged in from (if applicable).

root@oco:~$ rusers -al 10.0.17.5
 htb-student     10.0.17.5:console          Dec 2 19:57     2:25