Remote shell daemon (Rshd)

Sample Image - Rshd.gif

Introduction

The Rshd service has been available in all UNIX systems for a long time. The same service, called Rshsvc.exe, provided by Microsoft only shipped with the Windows NT/2000 Server Resource Kit and it was not included in any Windows XP versions. Several years ago, I wrote the Rshd Windows application for sending commands on remote computers on the same LAN. It is a Winsock multithreaded console application and not a true service. The Rshd Windows application, with full source code provided for Windows 95/98/ME/NT/2000/XP, was designed and implemented to be convenient with some security included. I expect that my work will not be harmful to Windows security.

Implementation

The Rshd executes all commands for the Rsh program available in both UNIX systems and Windows NT/2000/XP. There is no Rsh on Windows 95/98/ME, but I have provided the Rsh application with full source code running on all 32 bit Windows operating systems.

The Rshd and Rsh were designed by using the object-oriented methodology and implemented by using C++. Figure 1 shows the hierarchy of the CRshd and CRsh classes.

The class CWinSocket encapsulates part of the Windows Socket Functions API and is similar to the MFC CAsyncSocket class. The CWinSocket class can handle both TCP and UDP. Both Rshd and Rsh are WIN32 applications and they are independent of MFC.

Description

The above Rshd is slightly different from the Rshd service shipped with UNIX and Windows NT/2000 server, but their functions are similar. It also provides remote execution facilities with authentication based on privileged port numbers from trusted hosts based on the .rhosts file. The Rshd listens and accepts the Rsh client for service requests at the BSD reserved port (normally 513-1023, however the range 0-512 should be fine if the Rsh was designed and implemented by yourself. I have added comments in source code. Therefore, please read the source code if you want to understand how it works). When a service request is received, the Rshd does the following:

Retrieves the name of the client to which a socket is connected and checks its port. If the port is not in the range 513-1023, the Rshd aborts the connection.
The server reads characters from the socket up to a null byte. The resultant string is interpreted as a 10 based ASCII number.
If the number received is non-zero, it is interpreted as the port number for a second connection to be used for the error feedback. The second connection is then created as a client to the specified port on the client's machine. The source port of this second connection is also in the range 513-1023.
Checks the client's source address and requests the corresponding host name. If the hostname cannot be determined (under Windows 95/98/ME), the dot-notation representation of the host address is used. If address verification fails, the connection is aborted.
A user name is retrieved on the initial socket. It is interpreted as the user identity on the client's machine (the Rsh sender).
Validates the host and the user retrieved on the initial socket, based on the record listed in the user's .rhosts file located in the directory specified in the file Rshd.ini, which is located in the same directory as the Rshd (Rshd.exe).
A command to be passed to a shell is retrieved on the initial socket. The length of the command is limited to less than 8192 bytes.
The command line is passed to the system call, which invokes cmd.exe command to interpret the command line.

Source code and projects

Source code consists of four projects: Rsh, Rshd, Stdn, and Utility. Rsh and Rshd are Win32 console applications, Stdn (Shutdown) is a MFC dialog based application, and Utility is a Win32 static library. If compiled successfully, they should be located in the Bin directory.

There are only two files Rsh.cpp/Rsh.h and Rshd.cpp/Rshd.h in the Rsh and Rshd projects, respectively. They contain many comments which can aid your understanding on how they work.

The Stdn project includes an important class CShutdown which contains two methods ShutdownNow and ShutdownAll. ShutdownNow is used to shutdown local computers and ShutdownAll to shutdown remote computers. However, ShutdownAll only works on Windows NT/2000/XP with administrator privileges.

The Utility project contains several useful classes:

CConfigFile: message logging and INI file reading class.
CLock: critical section wrapper class used by Rshd application.
CStr: string class. More details here.
CWinSocket and CWinSocketEx: Win32 socket wrapper classes used by Rsh and Rshd applications.
List: adopted from MFC List template. However, it is independent of MFC.

Case study: shutdown all computers on the LAN automatically

The Rshd and Rsh have successfully been applied to several power stations. The following step describes how to use Rshd and Rsh to access all computers by commands to each other on the LAN and shutdown them automatically. Assume that there are 6 computers running on different operating systems on the LAN: two UNIX, two Windows NT workstations, and two Windows 95. In this example, assume two UNIX host names are UHost1 and UHost2, and their user names are UUser1 and UUser2; two Windows NT workstations host names are WNT1 and WNT2, and their user names are WNTUser1 and WNTUser2; two Windows 95 host names are W951 and W952, and their user names are W95User1 and W95User2. An emergency shutdown device (button) is attached on WNT1.

Create a directory on Windows computers, say C:\RS\Bin. The RS directory should contain .rhosts, Rsh.exe, Rshd.exe, Rshd.ini, and Shutdown.exe. Rsh.exe does not conflict with the Rsh program provided by Windows NT/2000/XP.
Edit the .rhosts text file. The format of this file is host name followed by user name with tab or space delimited. It is loaded by Rshd.exe. The .rhosts should look like as follows (assume the following users login as the current user on each computer. However, many users may appear on the same host):
```
......
UHost1      UUser1
UHost2      UUser2
WNT1       WNTUser1
WNT2       WNTUser2
W951        W95User1
W952        W95User2
�..
```

Edit the Rshd.ini file. It is a standard Windows INI file and should look like follows:

[Path]
HostFile = C:\RS\Bin\.rhosts           ; host file location
LogFile = C:\RS\Bin\rshd.log          ; log file location
 
[Info]
Debug = 1  ; 1 (or non zero): Log file records 
                    Rsh sender information; 0: not

Create the Rshd.exe shortcut and put it into the Windows startup menu. When Windows starts up, Rshd.exe should be found in the Task Manager. If not, manually run it.
Add the four Windows computers information into the .rhosts file on each UNIX computer. Please read UNIX manual on how to modify the .rhosts file. We assume that UUser1 and UUser2 have a Shutdown script file under their home directory, respectively. They have same privileges as root to run it. The Shutdown script does actual shutting down task.

Create a batch file in C:\RS\Bin on WNT1. The batch file (invoked by pressing the emergency shutdown button) should look like the following:

Rsh UHost1 Shutdown
Rsh UHost2 Shutdown
Rsh WNT2 C:\RS\Bin\Shutdown -d
Rsh W951 C:\RS\Bin\Shutdown -d
Rsh W952 C:\RS\Bin\Shutdown -d
Shutdown -d

That is all for setting how to shutdown all computers on the LAN automatically. When the emergency shutdown button is pressed, all 6 computers should be shut down.

Security free consideration

The .rhosts and Rshd.ini files are not necessary if you consider writing your security free Rshd service. To do so, simply modify the Rshd.cpp and remove CheckConfFile, LoadRHostsFile, and CheckHostAndUserName function calls. However, security free Rshd service is dangerous and any computer on the same LAN can easily destroy the Rshd service computer system. It is a good practice setting .rhosts to only let the trusted computers to access.

Running Rshd on Windows operating systems may cause some security issues. I am not responsible for any damage in your computer system caused by using it.

You must Sign In to use this message board.


Per page

found 2 bugs in the code
matt.ratus

1:03 27 Sep '07

Built this under VS2003 and am running it on XP SP2. I've incorporated the edits from yaseeen's mail to get it compiling ok. I've gone with all the options set on the original
project, except swapped to using /MTd (i.e. no .dll required)

So then it runs ok, but quite often just does not execute a request from rsh.

So: one problem is the use of tmpnam() - which, if you read the comments only guarantees
to work in a single run of a process upto TMP_MAX times - which can be as low as 26. After that anything can happen -ie it does not guarantee to get you a unique filename. Well, obviously not much good in a daemon process which could be processing n,1000 requests per session - and you can see the error with creating temp files is output in the rshd.log file... So in CRshdSocket::ExecCommand I've replaced it with:


        char  TempFile[256], TempErr[256];
        // get the full temp directory path from environment variables
        char* TempDir = getenv("TEMP");

	// init buffers
	CStr ComBuff = Command;
	memset(TempFile, 0, sizeof(TempFile));
	memset(TempErr, 0, sizeof(TempErr));
	if(!TempDir)
    {
		strcpy(TempFile, ".");
    }
    GetTempFileName(TempDir, "rsh", 0, TempFile);

	// redirection on 
	ComBuff += " >";
	ComBuff += TempFile;

	if (m_pRshd->GetWinOSVersion())
	{
        if(TempDir)
        {
            strcpy(TempErr, ".");
        }
        GetTempFileName(TempDir, "rse", 0, TempErr);


	}

That improves it quite alot - but there were *still* problems, in that it was still ignoring
commands occasionally - this time without error indication in the log - it was particularly
bad when running a series of rsh commands from a bat file. I tracked down where the error
was manifesting itself and have a fix, but, quite frankly I don't really know why it's a
problem.

The problem is in CRshdSocket::OpenTempSocket() - and in here it occasionally loses the command (stored in Buff + i) - it just gets reset to an empty string. However I found that
if i change the code from:


// try to send the client only one byte to check the it status
    Buff[0] = 0;
    if (Send(Buff, 1) < 1)

TO:


// try to send the client only one byte to check the it status
    char XBuff[10];
    XBuff[0] = 0;
    if (Send(XBuff, 1) < 1)

then it all works fine - but I don't know why! In theory the old code should work (although
the way it's written is a bit obscure), and most of the time it does work. So I suspect that
there is a race condition due to the multithreading and my "fix" is just hiding the real issue. But I'm not wasting more time on this for now - it works for me, and I've got other things to do. Anyone who finds out what the real problem is, please post back (or: maybe just a link to another rshd program that is more robust then this one).

No EXE files in download
rswain

9:49 12 Nov '06

Hi, There are no .exe files in the download demo version. How do you build them as I don't have a compiler. The documentation implies that there are .exe files included. Many Thanks Richard Swain
Sign In·View Thread·PermaLink	2.00/5

Executable on Win 2k?
Bert Cohen

10:31 26 Jun '06

Hi, Is it possible to get a copy of the executable for Win2K? Thanks Bert
Sign In·View Thread·PermaLink	1.50/5

RSH using pure C
joefsg

4:09 3 Jun '06

hi there,

my name is joe and i am interested in your rsh source code.
Since some weeks i am looking for a telnet\rlogin client source.
My problem is, that i am not realy into socket programming and i am tryn to get a telnet\rlogin written in C only. I am actualy developing a not-commercial video-game and thats what i need a rsh\telnet code for. I ve already tryed to port your rsh code into my but it wont work. Since i am using the "Quake 3 engine
" i would need a c implementation anyway. So you may have a another code, maybe written in c, that i can build into my own c code??

thank you,

Joe

binaries
993tt

11:33 11 May '06

Hi. Could you please send me the binaries to run on Win2K server? Thanks. Tom
Sign In·View Thread·PermaLink	2.00/5

compile on Visual Studio .NET 2003 ??
yaseeen

0:00 5 May '06

Hello, i can't compile the Demo on VS .NET 2003. It doesn't work. fatal error C1083: Cannot open include file: 'fstream.h': No such file or directory fatal error C1083: Cannot open include file: 'iostream.h': No such file or directory Can you help? regards Demir
Sign In·View Thread·PermaLink

Re: compile on Visual Studio .NET 2003 ??
yaseeen

1:03 5 May '06

Ok i find it Smile

Compile works on VS .NET 2003.

you have to delete the extension <***.h> at <iostream.h> and <fstream.h>.
Then you need "using namespace std;"

That looks like so:

---rsh.cpp---
#include <iostream>
#include <stdio.h>
#include <process.h>

using namespace std;

---Confile.cpp---
#include <windows.h>
#include <io.h>
#include <fstream>
#include <stdio.h>
using namespace std;

#include "Confile.h"

in List.h you have to put typename's

---list.h---

         template<class TYPE, class ARG_TYPE>
         typename List<TYPE, ARG_TYPE>::CNode*
         List<TYPE, ARG_TYPE>::NewNode(typename List::CNode* pPrev,typename List::CNode* pNext)

and

         template<class TYPE, class ARG_TYPE>
         void List<TYPE, ARG_TYPE>::FreeNode(typename List::CNode* pNode)

Confile.cpp change to:

     // Log error
     ofstream fLogFile (m_LogFile, ios::app);   //deleted filebuff::openprot
     fLogFile << szDate << " , " << szTime << endl;
     if (Function)
     {
          fLogFile << "Function: " << Function << endl;
          fLogFile << "Index:      " << nLine << endl;
     }
     fLogFile << m_LogText << endl;
     fLogFile << "-------------------------------------------------------" << endl;

     Unlock();

---------------

now you could compile Smile

regards

Demir

How to compile in VS 2005
ratass2002

8:58 21 May '06

First of all follow all the above steps.

Secondly you have to do the following.

Add "wd 4430" to "Configuration Properties | C/C++ | Command Line"to avoid error 4430 - missing type specifier. Add this change to the project with this problem. I think Rsh and Utility projects have this problem.

Small change From:

len = (int)pow(2, i);

To:

len = (int)pow(2.0f, i); //it was complaining it was ambiguous

Great project!

Re: How to compile in VS 2005
ratass2002

9:40 21 May '06

I forgot to mention that you need to do the following

"Configuration Properties | C/C++ | Code Generation"
Under "RunTime library" select the "Multi-Threaded Debug /MTd" or "Multi-Threaded /MT" according to your compiler setting (i.e.: debug or release).

VS 2005 selects /MD and /MDd by default which makes your output binaries small (you might like that) but your program might not run successfully on all platforms. Basically you don't want the DLL dependencies to be on the client machine but rather in your binaries. If you use "/MT" and "/MT" the resulting files are bigger but they won't have dependencies.

When I first loaded the project I saw that "/MT" (usually for release mode) was applied to my debug build and it was complaining something is already defined in some .lib file. Usually this is a library linking problem (linking debug and release together for example or order of linkage). When all the correct libraries (are being used) are linked in the correct order and you still get an error there is actually one command to ignore this problem but I can't remember what it is (i'll post back when I find it).

Regarding Problem using Demo Project
ntimesc

21:18 2 Apr '06

hi, i had tried a lot to run the demo project on WIndows XP but it is not running. so could u just explain me how to run this project on windows xp... The Only Way To Get Smarter is By Playing Smarter Opponent
Sign In·View Thread·PermaLink	1.00/5

PASSWORD??
joefsg

23:53 25 Mar '06

why there is no password authentification===????? when i try to login to my FreeBSD Server, is says @Login incorrect all the time!! Joe
Sign In·View Thread·PermaLink

Binaries too
eeggaa

6:15 22 Mar '06

Could you send me the executable files, please Emilio Gutierrez
Sign In·View Thread·PermaLink

Compile error
URBANPROJECT

6:35 3 Feb '06

Hi, Could you send me the binaries files because I can´t compile the rshd source Thanks, Laurent
Sign In·View Thread·PermaLink

Binaries Too!
silo_xtreme

12:32 1 Feb '06

Hi can i please have the binaries (someone), I am having troubles compiling
Sign In·View Thread·PermaLink	1.00/5

Did anyone get copies of the binaries? -- I want too, please...
paulbeam

16:41 11 Jul '05

I don't have access to a compiler. Thanks much.
Sign In·View Thread·PermaLink	3.50/5

rcp from other machine : invalid port number
Michel GIRARD_TA

23:11 15 Jun '05

Hello,

First of all, I highly appreciated your hwole job (good source files, good VisualStudio workspace, good explanations) !
I generated the binaries very quickly (one shot !).
I successfully remote execute "dir c:\" for example, from a Linux machine. using rsh.
My problem is that, when I try to copy a file from the linux machine to the PC (under Windows XP Pro) using the following command :
rcp filetocopy MyPC:filecopied"
, rshd writes the following message (in rshd.log) :
"Client port (0) out of the 513-1023 range"
(I slightly changed rshd.cpp so it tells the incriminated port number).

I also tried to copy a file from the PC to the PC using the following coommand :
"rcp MyPC:filetocopy filecopied"
I alternatively get the following messages (in the cmd window) :
"Connection timeout"
and
"Wrong error number".
Nota : the above messages are translated from french, so they might slightly differ from the real ones.

I hope this message will reach and interest you.

Thank you in advance.

P.S My brief profile : Michel GIRARD, 49 years old, leaving and working in south of France, interested in software (C++, ...)

Binaries too!
cesarsouza

13:48 31 Mar '05

I'm unable to compile your program in recent versions of VC, borland, gcc mingw and whatever compiler I found near me... So can you please send me these binaries? thanks in advance Cesar
Sign In·View Thread·PermaLink

Binaries
jairorod

11:46 5 Jan '05

Could you send me the executable files , I can´t compile the source thanks in advances, Jairo J. Rodriguez U.
Sign In·View Thread·PermaLink	5.00/5

no execute
johnsevillano33

14:26 16 Sep '04

I do it all
I copy files in c:\Rs rsh.exe rshd.exe rshd.ini and the others
mi .rhost file is configure as

host user name
jsevillano jsevillano

then I start rshd.exe
and from the prompt
type rsh jsevillano -l jsevillano dir c:\
but nothing results display

mi log file
display this

*******************************************************
C:\RS\rshd.log LOG FILE
jueves, 16 de septiembre de 2004 , 18:30:03
Software version: Version 1.02
*******************************************************
jueves, 16 de septiembre de 2004 , 18:30:11
Function: CheckClienInfo
Index: 0
Remote host name = jsevillano.reniecperu.net
-------------------------------------------------------
jueves, 16 de septiembre de 2004 , 18:30:11
Function: OpenTempSocket
Index: 0
Remote user name 'jsevillano' is accesing the Rshd service
-------------------------------------------------------
jueves, 16 de septiembre de 2004 , 18:30:11
Function: OpenTempSocket
Index: 4
Host name = 'jsevillano.reniecperu.net' : user name = 'jsevillano' have something wrong
-------------------------------------------------------

when i try with user remote is the same

somebody can help me

DSKJHDLdlhahd

Re: no execute
Yuantu Huang

15:54 22 Sep '04

I think your host name is jsevillano.reniecperu.net. So try jsevillano.reniecperu.net instead of jsevillano. Dr. Yuantu Huang
Sign In·View Thread·PermaLink

binary
Deepak Mahbubani

23:07 1 Jul '04

Could you please mail me the binaries.
Sign In·View Thread·PermaLink	1.00/5

Re: binary
Yuantu Huang

16:17 22 Sep '04

Hi Deepak, How can I get your email address to send you the binary files. I think the easy way is to compile the source code using VC 6.0. Yuantu
Sign In·View Thread·PermaLink

no error and no output; log: "have something wrong"
Mark2

23:59 20 Jun '04

hello,

I tried two NT4 workstations with SP6a. What I did was:
1. on server I create a directory C:\RS and copied all files from your bin directory into
2. on server started rshd.exe, console closes immediately
3. rshd.exe is running, shown by taskmanager
4. on client (named asterix) I started rsh server dir c:\ but I got no output
5. checked logfile on server:
Function: CheckClienInfo
Remote host name = ASTERIX
Function: OpenTempSocket
Remote user name 'Administrator' is accesing the Rshd service
Function: OpenTempSocket
Host name = 'ASTERIX' : user name = 'Administrator' have something wrong

Do you have an idea ?

thanks for your efforts
regards Mark

Re: no error and no output; log: "have something wrong"
Yuantu Huang

16:13 22 Sep '04

Hi Mark, Do you add a line containing remote host name and user name? If not, please add it in. I think it will fix your problem Yuantu
Sign In·View Thread·PermaLink

Cannot accept the error output socket
Mark2

23:29 22 Sep '04

Hi Yuantu,

thanks for answering! it helps, but now I got an error on client:
---------------------------------------------
C:\RS>rsh Troubadix Administrator
The error output socket is trapping in accept
Can not accept the error output socket
---------------------------------------------
and the server log contains:
---------------------------------------------
Function: OpenErrorSocket
Errorcode: WSAEADDRINUSE
---------------------------------------------
which ip adress/port you are using? can I specify anotherone on startup?

thanks and regards
Mark

PS: sorry if you got this twice