Why does rlogin to Metasploitable 2 as a root ask password?

Question

I pentest a Metasploitable 2 through VPN.

I can login with rlogin as msfadmin, but I can't as a root.

I've installed the rsh-client on my kali. And the exploit works on my local VM Metasploitable 2 too.

What could be the problem?

You can read about this exploit here:

https://community.rapid7.com/docs/DOC-1875 (search rlogin)

I checked the .rhosts file on the target (with a different exploit):

Answer 1

First, we have to find out what is the problem. Because we can access the target machine we can check the logs of authentication after a failed login attempt:

root@metasploitable:~# cat /var/log/auth.log
...
Jun 27 01:08:25 metasploitable rlogind[8491]: pam_securetty(rlogin:auth): access denied: tty 'pts/0' is not secure
...

I don't know what is pam securetty, so let's check it: http://linux.die.net/man/8/pam_securetty

"pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in /etc/securetty. pam_securetty also checks to make sure that /etc/securetty is a plain file and not world writable."

Okay, next step: Let's check this file:

root@metasploitable:~# cat /etc/securetty
# /etc/securetty: list of terminals on which root is allowed to login.
# See securetty(5) and login(1).
console
...
# General
pts/1
pts/2
...

Okay, the problem is that, there is no pts/0. But we are lucky because pts/1 is allowed to login.

So the trick is this: 1) Open 2 kali terminal 2) Try to login from them at the same time:

# rlogin -l root <IP>

3) profit

Answer 2

Look ip of both vms.. the metasploit and kali They should be in same network If they are not then before starting these vms in Virtual box, go into settings > network > chose host-network-adapter in both. Then start and retry.