rsync privilege escalation via sudo

rsync copies files preserving metadata, and that is where the abuse lies when it shows up in a sudo -l that lets it run as root. There are two routes, depending on how much freedom the rule gives over the arguments.

Route A: direct shell with -e (GTFOBins)

If the rule allows passing free arguments, rsync's -e option (which defines the "remote shell") runs an arbitrary command as root. It is the cleanest form and the one GTFOBins documents:

sudo rsync -e 'sh -c "sh 0<&2 1>&2"' 127.0.0.1:/dev/null
id     # uid=0(root)

Route B: SUID via metadata preservation

When the rule fixes the source with a wildcard (sudo rsync -a /home/dev/app/* /opt/app/), you exploit the fact that rsync runs as root and preserves permissions: you place in the source (writable by us) a bash with the SUID bit and let the privileged rsync copy it to the destination as root:root, keeping the SUID:

cp /bin/bash app/bash
chmod u+s app/bash
sudo /usr/bin/rsync -a --chown root:root /home/dev/app/* /opt/app/
/opt/app/bash -p          # SUID root + -p keeps the EUID: root shell

The key is the combination: the source is writable by us, rsync runs as root, and --chown (or -a itself if the binary were already root-owned) leaves the file owned by root with the SUID intact. Then bash -p does not drop the effective privileges and we get root.

Requirements

A sudo rule over rsync runnable as root. Route A only needs to be able to pass arguments; route B needs the source to be a directory writable by us and the copy to preserve permissions (-a/-p) or allow --chown.

How to detect it. The use is recorded in /var/log/auth.log as a sudo ... COMMAND=/usr/bin/rsync, and auditd logs the execve with the full command line: an rsync with -e 'sh ...', or with a destination in sensitive paths (/opt, /usr/local, /etc) from a non-admin account, is the signature. A new SUID binary appearing after the copy (compared against a baseline of find / -perm -4000) gives away route B. Sysmon for Linux or auditd over execve with sh -c as a child of rsync closes the detection.

Defence. Avoid sudo over rsync; if unavoidable, fix exact source and destination without *, forbid -e/--rsh with NOEXEC or a rule that does not admit free arguments, and periodically review unexpected SUID files. It is a cousin of the rest of the GTFOBins-via-sudo abuses.