# Rsync \[873]

<details>

<summary>Info</summary>

[Rsync](https://linux.die.net/man/1/rsync) is a fast and efficient tool for locally and remotely copying files. It can be used to copy files locally on a given machine and to/from remote hosts.&#x20;

</details>

<details>

<summary>Guide</summary>

This [guide](https://book.hacktricks.xyz/network-services-pentesting/873-pentesting-rsync) covers some of the ways Rsync can be abused, most notably by listing the contents of a shared folder on a target server and retrieving files. This can sometimes be done without authentication. Other times we will need credentials. If you find credentials during a pentest and run into Rsync on an internal (or external) host, it is always worth checking for password re-use as you may be able to pull down some sensitive files that could be used to gain remote access to the target.

</details>

<details>

<summary>Nmap Rsync</summary>

```bash
z3tssu@htb[/htb]$ sudo nmap -sV -p 873 127.0.0.1
```

</details>

<details>

<summary>Probing for accessible shares</summary>

We can next probe the service a bit to see what we can gain access to.

&#x20; Linux Remote Management Protocols

```bash
z3tssu@htb[/htb]$ nc -nv 127.0.0.1 873

(UNKNOWN) [127.0.0.1] 873 (rsync) open
@RSYNCD: 31.0
@RSYNCD: 31.0
#list
dev            	Dev Tools
@RSYNCD: EXIT
```

</details>

<details>

<summary>Enumerating Accessible Share</summary>

{% code overflow="wrap" %}

```bash
rsync -av --list-only rsync://127.0.0.1/dev

rsync rsync://10.129.225.48/ --list-only

```

{% endcode %}

</details>

<details>

<summary>Syncing Shares to our Attacker Machine</summary>

we could sync all files to our attack host with the command&#x20;

`rsync -av rsync://127.0.0.1/dev`.&#x20;

If Rsync is configured to use SSH to transfer files, we could modify our commands to include the `-e ssh` flag, or `-e "ssh -p2222"` if a non-standard port is in use for SSH. This [guide](https://phoenixnap.com/kb/how-to-rsync-over-ssh) is helpful for understanding the syntax for using Rsync over SSH.

</details>

<details>

<summary>Downloading Contents of a Share</summary>

```bash
rsync rsync://10.129.225.48/public/flag.txt .
```

</details>
