Rsync

Rsync is a file synchronization and transfer utility commonly used for backups, mirroring, and file distribution. When running as a daemon, it listens on TCP port 873. Nmap identifies the service as rsync.

An exposed rsync daemon can be a significant finding. When modules (shared directories) are configured without authentication, anyone can list available modules and download their contents. This frequently exposes backup files, configuration data, source code, credentials, and database dumps. Writable modules allow an attacker to upload files, which can lead to code execution if the synced directory is served by a web server or processed by an application.

Enumeration begins with listing available modules using rsync --list-only rsync://target:873/. Each module can then be explored for accessible files. Nmap's rsync-list-modules script automates the initial discovery. Testing for anonymous read and write access on each module, checking for sensitive files in exposed backups, and attempting credential brute-force on authenticated modules are the standard assessment steps.