Rsync checksum comparison uninitialized stack memory disclosure

This repository contains a proof-of-concept exploit for CVE-2024-12085, an infoleak vulnerability in rsync 3.2.7. The main exploit is implemented in 'exploit.py', which connects to a hardcoded rsync server at 127.0.0.1:1234, targeting a module named 'test' and a file 'hello.txt'. The exploit crafts and sends a series of protocol messages to the rsync server, exploiting the vulnerability to leak up to 56 bytes of stack memory, which are then printed as 8-byte words. The exploit is not versatile; it is hardcoded for the specific module and file, and checksum calculation is not fully automated. Supporting files include 'checksum.py' (for checksum calculation, incomplete), 'port-forwarding.py' (a TCP port forwarding utility for capturing traffic), and 'test.sh' (a bash script to automate testing with a local rsync daemon). The attack vector is network-based, requiring access to the rsync service. The exploit does not provide remote code execution or shell access, but demonstrates the ability to leak sensitive memory from the server process.