rsync is best known as a file-sync tool over SSH, but it also runs as a standalone daemon listening on TCP 873, exposing named modules that behave like shares. Daemon modules are configured in rsyncd.conf, and they are commonly left anonymous (no auth users) and sometimes writable, with varying chroot and privilege settings. The offensive surface is enumerating the exposed modules, reading their contents without credentials, and writing to any module that allows it, which plants files on the host within whatever the daemon's chroot and privileges permit.
# list modules exposed by the rsync daemon (no credentials needed to list)
rsync rsync://<target>/ # or: rsync <target>::
nmap -p873 --script rsync-list-modules <target>
Subtopics#
- Module enumeration: listing modules and their access.
- Anonymous file access: reading module contents without auth.
- Write access: planting files through a writable module.