873 - Pentesting Rsync
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
From :
rsync is a utility for efficiently and between a computer and an external hard drive and across by comparing the and sizes of files. It is commonly found on . The rsync algorithm is a type of , and is used for minimizing network usage. may be used for additional , and or can be used for security.
Default port: 873
Rsync modules are recognized as directory shares that might be protected with passwords. To identify available modules and check if they require passwords, the following commands are used:
Be aware that some shares might not appear in the list, possibly hiding them. Additionally, accessing some shares might be restricted to specific credentials, indicated by an "Access Denied" message.
Upon obtaining a module list, actions depend on whether authentication is needed. Without authentication, listing and copying files from a shared folder to a local directory is achieved through:
This process recursively transfers files, preserving their attributes and permissions.
With credentials, listing and downloading from a shared folder can be done as follows, where a password prompt will appear:
To upload content, such as an authorized_keys file for access, use:
To locate the rsyncd configuration file, execute:
Within this file, a secrets file parameter might point to a file containing usernames and passwords for rsyncd authentication.
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.