Ctrlk
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Rsync - Port 873

Basic info

Rsync is a fast and versatile utility for transferring files remotely while minimizing data transfer using delta encoding. It is often used in backup and mirroring operations across Linux-based systems. However, its default configurations can expose sensitive information and unauthorized file access, making it a prime target during network service penetration testing.

Understanding How Rsync Works

Rsync operates over TCP, commonly on port 873, and uses a synchronization protocol to efficiently update files across systems. It supports both anonymous and authenticated access. When misconfigured, Rsync can allow attackers to list directories, read sensitive files, and even upload malicious content.

Basic Rsync Connection Structure:

  • Modules: Exported directory paths made available via the Rsync server.

  • Access Control: Can be configured per module using rsyncd.conf.

  • Authentication: Optional, often misconfigured or completely absent.

Initial Enumeration of Rsync Services

Port Scanning

Use Nmap to detect Rsync:

This reveals whether the Rsync service is active and provides module listings if anonymous access is enabled.

Typing any string followed by [ENTER] may return a list of modules or version info if unauthenticated access is permitted.

Exploiting Anonymous Rsync Modules

When Rsync is configured to allow anonymous read access, attackers can extract full directory listings and files.

Discovering Public Modules

This command will return all available modules exposed by the server.

Listing Files Inside a Module

Rsync modules are recognized as directory shares that might be protected with passwords. To identify available modules and check if they require passwords, the following commands are used:

Be aware that some shares might not appear in the list, possibly hiding them. Additionally, accessing some shares might be restricted to specific credentials, indicated by an "Access Denied" message.

Downloading Files from a Module

This enables full recursive download of the exposed directory structure and contents.

Identifying Sensitive Data

During enumeration, focus on:

  • Config files (*.conf, settings.py)

  • Credential dumps

  • SSH keys

  • Backup folders (e.g., /etc/, /var/www/, /home/)

Brute Forcing Rsync Credentials (If Authentication Is Enabled)

Rsync uses a challenge-response mechanism based on rsyncd.secrets. Brute-forcing weak credentials may provide access to restricted modules.

Tool: rsync-brute

If access is granted, reuse earlier enumeration and download techniques.

Upload-Based Attacks

When write access is enabled (either anonymously or post-authentication), it’s possible to:

  • Inject Web Shells: Target modules synced with web roots (e.g., /var/www/html)

  • Overwrite Configurations: Drop malicious configs to alter service behavior

  • Poison Backup Systems: Place files to be replicated into other sensitive areas

Learn & practice For the Bug Bounty

Support VeryLazyTech 🎉
PreviousEPP - Port 700NextRusersd Service - Port 1026

Last updated