Exploitation

Rsync exploitation targets modules that allow unauthenticated access. List available modules with rsync rsync://target/ and then pull their contents. Sensitive modules exposing /etc/, home directories, web roots, or backup directories give you configuration files, SSH keys, credentials, and application source code.

Readable modules are the obvious target, but writable modules are more dangerous. Uploading a webshell to a web root module, injecting an SSH key into an authorized_keys file, or dropping a crontab entry into a cron directory turns file access into code execution. Combine readable and writable access on the same module to replace application code or configuration with backdoored versions.

When modules require authentication, brute-forcing the rsync password with Ncrack or custom scripts is straightforward since rsync uses a simple challenge-response mechanism. The password file (rsyncd.secrets) often contains weak credentials, especially on modules set up for automated backups.