I pentest a Metasploitable 2 through VPN.I can login with rlogin as msfadmin, but I can't as a root. I've installed the rsh-client on my kali. And the exploit works on my local VM Metasploitable 2 too.What could be the problem? You can read about this exploit here:https://community.rapid7.com/docs/DOC-1875 (search rlogin)I checked the .rhosts file on the target (with a different exploit):
Why does rlogin to Metasploitable 2 as a root ask password?
kali linux
First, we have to find out what is the problem. Because we can access the target machine we can check the logs of authentication after a failed login attempt:root@metasploitable:~# cat /var/log/auth.log...Jun 27 01:08:25 metasploitable rlogind[8491]: pam_securetty(rlogin:auth): access denied: tty 'pts/0' is not secure...I don't know what is pam securetty, so let's check it:http://linux.die.net/man/8/pam_securettypam_securetty is a PAM module that allows root logins only if the user is logging in on a secure tty, as defined by the listing in /etc/securetty. pam_securetty also checks to make sure that /etc/securetty is a plain file and not world writable.Okay, next step: Let's check this file:root@metasploitable:~# cat /etc/securetty# /etc/securetty: list of terminals on which root is allowed to login.# See securetty(5) and login(1).console...# Generalpts/1pts/2...Okay, the problem is that, there is no pts/0. But we are lucky because pts/1 is allowed to login.So the trick is this:1) Open 2 kali terminal2) Try to login from them at the same time:# rlogin -l root <IP>3) profit