Recon#

nmap -sV -p 873 $target

Probing share dirs#

More

nc -nv $target 873
rsync -av --list-only rsync://$target/<dir>

Retrieve shared files#

rsync -av rsync://$target/<dir>

More

rsync -av rsync://$target/<dir> -e 'ssh -p22'