rsync Enumeration

rsync is a fast file copy and synchronization tool widely used for backups and mirrors. When it runs as a daemon (by default on port 873) it exposes "modules", which are shared folders. The problem is that it is often configured without authentication, so an attacker can list and download the contents of those modules with no credentials, and there you usually find backups, SSH keys, or configuration files with secrets.

Mechanism

First confirm the service with a version scan, which also shows the protocol:

nmap -sV -p873 <ip>

A raw nc connection returns the daemon's greeting (@RSYNCD: 31.0), but the practical move is to list the available modules with the client itself:

rsync -av --list-only rsync://<ip>/
rsync -av --list-only rsync://<ip>/<module>

If a module is accessible, sync its contents down to the attacker machine to review at leisure:

rsync -av rsync://<ip>/<module> ./loot

When rsync is configured over SSH instead of as a daemon, add -e ssh (or -e "ssh -p<port>" if the port is non-standard).

Requirements

Listing and downloading anonymous modules requires nothing. Other deployments do ask for a username and password (defined in a server-side secrets file); in that case, if you have collected credentials elsewhere in the environment, it is worth trying reuse, because rsync often falls outside rotation policies.

How to detect it

Enumeration is given away by anonymous connections to port 873, module-listing requests (--list-only) from unauthorized IPs, and large transfers of entire modules to the outside. The rsync daemon's logs record every connection and the requested module.

Defence. Require authentication (auth users + secrets file), mark modules as read only, restrict with hosts allow/hosts deny, and avoid exposing port 873 outside the management network. Related to anonymous FTP, credential reuse and SSH key injection.