Skip to content
HackIndex.io

rsync module enumeration

3 min read Created Jan 26, 2026 Last updated Aug 12, 2026

Rsync daemon mode exposes named modules: each a configured directory path with its own access controls. Module enumeration lists what is available and whether authentication is required. Unauthenticated read access means arbitrary file download from that path. Unauthenticated write access means file planting. Both are high-impact findings. This page covers discovery and access validation: exploitation is covered in file access and loot and write access exploitation.

  • Service Detection
  • List Modules: nmap NSE
  • List Modules: rsync Client
  • Check Read Access Per Module
  • Check Write Access
  • Authenticated Module Access
  • Credential Bruteforce

Service Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 873 $TARGET_IP 
873/tcp open  rsync   (protocol version 31)

List Modules: nmap NSE

┌──(kali㉿kali)-[~]
└─$ nmap -p 873 --script rsync-list-modules $TARGET_IP 
| rsync-list-modules:
|   public          Public files
|   backup          Nightly backups
|_  www             Web root

List Modules: rsync Client

Faster and works without nmap. Use this for all follow-on operations too:

┌──(kali㉿kali)-[~]
└─$ rsync --list-only rsync://$TARGET_IP:873/ 
public          Public files
backup          Nightly backups
www             Web root

If listing returns modules, check read access on each immediately. If listing is denied with an error like @ ERROR: auth failed to connect or @ ERROR: Unknown module, the daemon requires authentication or does not expose the module list anonymously.

Check Read Access Per Module

List the contents of each discovered module without downloading. Size and file count give you a quick sense of what is inside before pulling:

┌──(kali㉿kali)-[~]
└─$ rsync --list-only rsync://$TARGET_IP:873/backup/ 
drwxr-xr-x          4,096 2026/03/28 12:00:00 .
drwxr-xr-x          4,096 2026/03/01 08:00:00 configs
-rw-r--r--         81,920 2026/03/01 08:00:00 db_dump.sql
-rw-r--r--          2,048 2026/03/01 08:00:00 .env
┌──(kali㉿kali)-[~]
└─$ rsync --list-only rsync://$TARGET_IP:873/www/

A .env file and db_dump.sql in the backup module are immediate high-value targets. Pull those specific files rather than the whole module when disk space or speed matters.

Check Write Access

Confirm whether the module accepts uploads by attempting to sync a test file:

┌──(kali㉿kali)-[~]
└─$ echo 'write_test' > /tmp/rsync_writetest.txt
┌──(kali㉿kali)-[~]
└─$ rsync /tmp/rsync_writetest.txt rsync://$TARGET_IP:873/www/ 2>&1 
@ ERROR: module is read only
rsync error: error starting client-server protocol (code 5) at main.c(1649) [sender=3.1.3]
┌──(kali㉿kali)-[~]
└─$ echo 'write_test' > /tmp/rsync_writetest.txt
┌──(kali㉿kali)-[~]
└─$ rsync -v /tmp/rsync_writetest.txt rsync://$TARGET_IP:873/www/rsync_writetest.txt 2>&1 
rsync_writetest.txt

sent 74 bytes  received 35 bytes  218.00 bytes/sec
total size is 10  speedup is 0.09

A successful sync without errors confirms write access. Clean up the test file immediately and move to write access exploitation. If the server returns @ ERROR: read only, the module is read-only: move to file access and loot instead.

Authenticated Module Access

When a module requires credentials: indicated by an @ ERROR: auth failed response: provide them via the URL:

┌──(kali㉿kali)-[~]
└─$ rsync --list-only rsync://$USER@$TARGET_IP:873/backup/ 2>&1 
Password:
(enter password when prompted)
┌──(kali㉿kali)-[~]
└─$ RSYNC_PASSWORD=$PASSWORD rsync --list-only rsync://$USER@$TARGET_IP:873/backup/

Credential Bruteforce

┌──(kali㉿kali)-[~]
└─$ nmap -p 873 --script rsync-brute --script-args 'rsync-brute.module=backup' $TARGET_IP

References