ExamFinch.com My Study

Study guide

9.5 Unix Remote Information Services: rusers, rwho, finger & systat

Practice this exam

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

9.5 Unix Remote Information Services: rusers, rwho, finger & systat

Key Takeaways Explain This Topic AI

The finger daemon listens on TCP port 79 and returns login names, real names, home directories, shells, and idle and last-login times.

rwho relies on rwhod broadcasting login state on UDP port 513; ruptime reports uptime from the same data.

rusers is an RPC service (program number 100002) reached via the portmapper on port 111 and lists users logged in across the network.

rstatd (RPC program 100001) and the systat service (TCP port 11) leak system performance and process information respectively.

These services enrich a username list that then feeds password spraying, SMTP VRFY/EXPN confirmation and finger-based information gathering.

Last updated: September 2026

9.5 Unix Remote Information Services: rusers, rwho, finger & systat

Syllabus item F1 is precise: "Discovery of valid usernames from network services commonly running by default: rusers, rwho, SMTP, finger." It then requires you to "understand how finger daemon derives the information that it returns, and hence how it can be abused." These are legacy services from the era of trusted campus networks, and they survive on Solaris, AIX, HP-UX, embedded appliances and unhardened Linux hosts. Every one of them hands out user information to anyone who asks.

The reason this matters is the username half of a credential . Password attacks (spraying, brute force) need a valid user list, and account-lockout policies mean you cannot afford to waste attempts on non-existent names. A confirmed username is worth as much as half the credential.

1. The finger Service (TCP 79)

finger (RFC 1288) was designed so users could look up each other's contact details and login status. fingerd listens on TCP port 79 . finger @target.example.com # list all currently logged-in users

  • finger root@target.example.com # detail for a specific account
  • finger admin@target.example.com
  • A response is rich: Login Name TTY Idle When Where
  • jsmith John Smith pts/0 2 Tue 09:14 10.20.31.117
  • oracle Oracle User pts/1 15 Tue 08:02 dbadmin-lt
  • How fingerd Derives Its Output — and Why That Is Abusable

This is the exact point the syllabus calls out. fingerd builds its answer from files it reads on the host:

/etc/passwd — login name, the GECOS field (real name, office, phone), home directory and shell.

utmp / wtmp — who is currently logged in, on which terminal, from where, and idle time.

~/.plan and ~/.project — free-text files in each user's home directory whose contents finger prints verbatim.

lastlog — the last login time and source for each account.

Two abuses follow directly:

Username and account enumeration. Because the answer comes from /etc/passwd and utmp , finger user@host confirms whether an account exists, and finger @host dumps everyone currently logged in — including the source addresses they logged in from, which reveals administrator workstations and trust relationships. Some fingerd implementations even accept a query with no user or a wildcard , listing all known accounts.

Information disclosure and further abuse. The GECOS field leaks real names (feeding password guessing and social engineering) and phone/office data. The .plan file is attacker-influenced in some setups. Historically, fingerd also enabled the finger redirection / relay trick ( finger user@host1@host2 ), using one host to finger another and bypassing source-address controls — and the original 1988 Morris Worm spread partly through a fingerd buffer overflow, the canonical example of the service's danger.

The idle and last-login data is valuable operationally: an account idle for months is a candidate for takeover with less chance of the real user noticing.

2. rwho and ruptime (UDP 513)

rwho shows who is logged in across every host on the local network. It depends on the rwhod daemon, which broadcasts each host's login state on UDP port 513 and listens for the broadcasts of its peers, caching them under /var/spool/rwho . rwho # all users on all hosts that broadcast rwhod

ruptime # uptime, load and user count for each broadcasting host

ruptime reads the same cached data to report each host's uptime and load. The security problems:

Passive disclosure. Because rwhod broadcasts, an attacker on the segment simply listens on UDP 513 and harvests a live map of every host, every logged-in user, and each host's uptime — with no query sent. Uptime is itself useful: a host with a very long uptime has not been rebooted and is therefore likely missing kernel patches.

Broadcast amplification of the estate map. One rwhod gives you the whole broadcast domain's user population.

3. rusers and the RPC Family (portmapper 111)

rusers is the RPC-based equivalent of rwho . It is an ONC RPC service, program number 100002 , and like all RPC services it is located by first querying the portmapper (rpcbind) on TCP/UDP port 111 , which returns the dynamic port rusersd is actually listening on. rpcinfo -p target.example.com # enumerate RPC services and their ports

  • rusers -l target.example.com # long listing: users, TTYs, idle times
  • rusers -al 10.20.30.0 # -a includes hosts with no users logged in sysadmin target:pts/0 Sep 14 09:14 :22
  • backup target:pts/2 Sep 14 03:00 1:47

The related RPC/legacy services in the same family, all named or implied by the syllabus:

  • Service Port / RPC program Leaks
  • rusersd RPC program 100002 (via portmapper 111) Users logged in across the network, with TTY and idle time

rstatd RPC program 100001 (via portmapper 111) System performance: CPU, disk, network, load — and thereby usage patterns

  • rwalld RPC program 100008 Accepts broadcast messages to all users (nuisance/DoS)
  • sprayd RPC program 100012 Packet-flood testing target
  • systat TCP port 11 Runs who / w / netstat -style output to any connector: live user and process list
  • netstat service TCP port 15 Legacy service echoing netstat output remotely

rstatd deserves a note: its performance data reveals when a host is busy or idle , letting an attacker time activity for low-observation windows, and older rstatd implementations carried remote format-string vulnerabilities .

The systat service (TCP 11) is the bluntest of all — connecting to it runs a who -style command and returns the live user and process listing directly, no client tool required: nc target.example.com 11 # systat: dumps who/process output

  • nc target.example.com 15 # netstat service: dumps connection table
  • 4. Chaining Into a Username List finger @host -> currently logged-in users + real names + source hosts
  • finger user@host -> confirm/deny a specific account
  • rwho / rusers -> users across the whole segment
  • systat (TCP 11) -> live who/process output
  • rstatd -> when the host is busy (timing)
  • |
  • v
  • Consolidated, de-duplicated username list
  • |
  • v
  • SMTP VRFY/EXPN (section 9.2) -> confirm which names are valid mail recipients
  • |
  • v
  • Password spraying / targeted brute force (mindful of lockout)

The value of F1 is that these services build the input to the credential-attack phase. A single finger @host can name every administrator and the workstation each logs in from; combined with GECOS real names it also seeds a realistic phishing campaign.

5. Detection, Reporting and Remediation

These services are almost never needed on a modern network, so the finding and the fix are simple:

Confirm exposure with nmap -p 11,15,79,512,513,514 <target> for the TCP/UDP legacy services and rpcinfo -p <target> for the RPC family.

Report the specific disclosure , not just "finger is enabled": name the accounts, real names and source hosts the service actually revealed, because that evidence is what conveys the risk.

Remediate by disabling the services entirely — remove fingerd , rwhod , rusersd , rstatd and the systat / netstat inetd entries; where a legitimate need exists, restrict them by firewall to management hosts only. Modern equivalents (SSH, monitoring agents with authentication) replace every legitimate use.

Treat username disclosure as a real finding even without a password , because it removes lockout-safe target selection and directly enables spraying and phishing.