Synced introduces rsync — a fast, incremental file transfer utility widely used for backups and deployments on Linux systems. When rsync is exposed on the network without authentication, it behaves like an anonymous FTP server but for entire directory trees. An attacker can list and download any module the daemon exposes, which often includes sensitive configuration files, private keys, and data backups.
| Skill | Why it matters |
|---|---|
| Identifying rsync with Nmap | Port 873 is uncommon enough that many defenders overlook it |
| Listing rsync modules | Module enumeration reveals what directories are shared without credentials |
| Downloading entire directory trees | Rsync downloads recursively — one command can grab gigabytes of data |
| Credential-free file access | No-auth rsync modules are a critical finding equivalent to anonymous FTP |
What you're seeing: rsync on port 873, its standard port. Protocol version 31 corresponds to rsync 3.x — the current stable line. No authentication headers in the banner means anonymous access is likely enabled.
Rsync organises shared directories into modules. List them by connecting without specifying a path.
What you're seeing: a module named public with no password. List its contents next.
-av before doing anything else. You want a local copy of everything before the window closes.| Command | What it does |
|---|---|
| rsync rsync://host/ | List all available modules on the daemon |
| rsync rsync://host/module/ | List files inside a specific module |
| rsync rsync://host/module/file . | Download a single file |
| rsync -av rsync://host/module/ ./dir/ | Recursively download entire module with verbose output |
| rsync -av --list-only rsync://host/module/ | List all files without downloading |
| rsync file rsync://host/module/ | Upload a file (if write access is permitted) |
An unauthenticated rsync module is functionally equivalent to an open network share. If write access is also enabled, it becomes a code execution vector — upload a cron job or authorized_keys file and wait.
| Concept | Real-world relevance |
|---|---|
| Port 873 in scope | Rsync is routinely missed in vulnerability scans that target only top-1000 ports |
| Anonymous modules | Backup modules commonly left open for convenience — contain database dumps, config files, SSH keys |
| Write access escalation | If rsync write is allowed to ~/.ssh/ or cron directories, achieving persistence is trivial |
| Full directory sync | Unlike FTP, rsync transfers entire trees in one command — faster exfiltration in a real engagement |