Solving the “Synced” Machine: A Practical Guide to Rsync Exploitation

This article details the steps to compromise the “Synced” machine, a ‘Very Easy’ difficulty challenge within the ‘Starting Point’ labs on Hack The Box. This particular machine marks the conclusion of Tier-0 for the Starting Point series and requires a VIP subscription to access.

Understanding Rsync: A Foundation for File Synchronization

Often, the need arises to efficiently synchronize files, transferring only modified portions rather than entire files. While File Transfer Protocol (FTP) remains a known service, its age and relative inefficiency for incremental updates make it less ideal for such scenarios. This is where Rsync (Remote Synchronization) shines.

Rsync is a powerful, open-source utility designed for fast, incremental file transfers. Its core innovation lies in its “delta-transfer” algorithm. Instead of copying whole files, Rsync intelligently detects and transmits only the differences between source and destination files, drastically reducing network bandwidth and transfer times. This makes it an excellent choice for backups, mirroring, and general file synchronization across local and networked systems, and it’s a standard utility in most Linux distributions.

The synchronization process typically involves three stages:
1. Establishing a connection and initiating a receiver process on the remote host.
2. Comparing files between the sender and receiver to identify changes.
3. Updating the remote host with the detected differences.

Interacting with the Rsync Service: Commands and Vulnerabilities

Interacting with an rsync daemon primarily uses the rsync command-line utility. The basic syntax for connecting to a remote rsync daemon to list available modules is:

rsync [OPTIONS] [USER@]HOST::[MODULE] [DESTINATION]
rsync [USER@]HOST:: (for listing available modules)

Key components of this command include:
* [OPTIONS]: Various flags to control rsync’s behavior (e.g., --help for a full list).
* [USER@]HOST: The target server’s IP address or hostname, with an optional username for authentication. For this challenge, we will attempt anonymous authentication.
* ::: The double colon signifies a connection to an rsync daemon, distinct from a remote shell.
* [MODULE]: Rsync daemons organize accessible files and directories into “modules,” acting like shared folders. Omitting this can sometimes list available modules.
* [DESTINATION]: The local path where synchronized files will be saved.

Rsync modules can employ different authentication methods:
* Anonymous: Accessible without credentials.
* Password-protected: Requires a username and password.

A significant security concern arises when rsync is misconfigured to allow anonymous access to sensitive modules, creating an exploitable vector for attackers to retrieve information.

Quick Questions:

• Default rsync port? 873
• Common Linux command for rsync? rsync
• Option to list shares/files only? list-only
• Credentials for anonymous authentication? None (you simply omit user/password)

Exploitation Steps: Capturing the Flag

Our objective is to leverage a potential misconfiguration to retrieve a flag file from the “Synced” machine.

Step 1: Network Reconnaissance with Nmap

We begin by scanning the target IP address to identify open ports and services using Nmap:

nmap -p- --min-rate=1000 -sV {target_IP}

• -p-: Scans all TCP ports (0-65535).
• -sV: Attempts to determine service versions.
• --min-rate=1000: Accelerates the scan by specifying a minimum packet rate.

The Nmap scan typically reveals that only port 873 is open, confirming the presence of an rsync service.

Step 2: Listing Available Rsync Modules

With the rsync service identified, we’ll try to list its available modules (shares) for anonymous users. The --list-only option is crucial for this, as it prevents any file transfers and simply enumerates the contents.

rsync --list-only {target_IP}::

This command should output a list of available shares. In the context of this machine, a module named public with the description “Anonymous Share” is usually visible.

Step 3: Enumerating Contents of the Public Share

Next, we investigate the contents of the public share. The trailing slash after the module name is important, as it indicates we want to list the directory’s contents rather than the directory itself.

rsync --list-only {target_IP}::public/

This command often reveals a file named flag.txt within the public share.

Step 4: Retrieving the Flag File

Finally, we download the flag.txt file to our local machine. We specify the source (public/flag.txt) on the remote server and the destination (flag.txt) as a new file in our current working directory.

rsync {target_IP}::public/flag.txt flag.txt

Upon successful execution, the command may not produce any output, but a new file named flag.txt will appear in your local directory. Reading its contents using cat flag.txt will reveal the flag.

Congratulations! You have successfully exploited an rsync misconfiguration to retrieve sensitive information and capture the flag. This marks the completion of Tier-0 of the Hack The Box ‘Starting Point’ labs. Happy hacking!