Skip to main content
Default Port: 873 Rsync is a file synchronization tool, and when it’s run as a standalone daemon rather than over SSH, it exposes “modules,” named directory shares, directly over the network on port 873. The real risk isn’t the protocol itself, it’s that modules are frequently left unauthenticated or writable, turning what should be an internal backup mechanism into an open door for reading or planting files.

Read-Only Module

Lets you list and pull files from a share. Still a real finding if it exposes backups, configs, or source code.

Writable Module

Lets you upload files into the share. Combined with the right target path, this is a direct route to remote code execution or SSH persistence.
Unlike most services on this site, rsync often requires no credentials by design, modules can be configured completely open. Always try listing before assuming you need a password.

​
Recon

A successful banner grab returns the protocol version directly, confirmation enough that the service is really rsync before going further:

​
Enumerating Modules

A “module” is rsync’s term for a shared directory. Listing them is the rsync equivalent of listing SMB shares, the first real step once you know the service is there.
Nmap and Metasploit cover the same ground if you’d rather stay inside a broader scan:
Once you have a module name, list its contents without downloading anything yet:

​
Pulling Files

​
Writable Modules

Confirm a module is genuinely intended to be writable before testing uploads, an open write module on a misconfigured server is a significant finding, but writing to it is still an active change to the target.
If a module allows writes, the most direct path to access is dropping your own SSH public key into a user’s .ssh directory, provided the module’s path actually exposes it.
If that succeeds, SSH in directly with the corresponding private key, no password or other credential needed.
A writable module doesn’t have to map to an SSH directory to be useful. Any writable path reachable by a web server, a cron job, or a startup script can potentially be turned into code execution, check what the module’s underlying directory actually corresponds to on the host.

​
Quick Reference Tools

Hackviser: Rsync

Quick-reference pentesting guide for the Rsync service.

HackTricks: Rsync

Deeper breakdown of Rsync enumeration and exploitation techniques.
Writing to a module, especially into an .ssh directory, grants persistent access to the target. Confirm this is explicitly in scope before going beyond read-only listing and downloads.