Unauthorized Access Vulnerability in Rsync
Vulnerability Description
Rsync is a data backup tool in Linux that supports remote file transfer through the Rsync protocol and SSH protocol. It is often used for code distribution and synchronization updates within the intranet, so the user group is mostly developers. The Rsync protocol listens to port 873 by default, and in the case of developers with weak security awareness, if the target has enabled the Rsync service and has not configured ACL or access passwords, we can read and write files on the target server.
Environment Setup
rsyncd.conf
uid = root
gid = root
use chroot = no
max connections = 4
syslog facility = local5
pid file = /var/run/rsyncd.pid
log file = /var/log/rsyncd.log
[src]
path = /
comment = src path
read only = noStart rsync
Vulnerability Exploitation
After the environment is started, we access it using the rsync command:
View src directory
This is a Linux root directory, and we can download any file:
Or write to a schedule:
Last updated