Driftsync

The service named after synchronization is the real attack surface. Don’t stop at identifying the daemon . enumerate what it’s willing to share anonymously.

Having private key to a server meant no password needed to SSH into the server. You'll still need the username and port number though (esp. custom port number). Read more here: https://www.ssh.com/academy/ssh/keygen

First question you should always whisper to a new shell: “what am I allowed to do that I shouldn’t be?” There’s one command, in particular, that answers that question for you in a single line. Run it.

Once you're in as labuser, check what commands you can run with elevated privileges — you might find a familiar text viewer that has no business running as root. Interactive pagers can do more than display text; consult GTFOBins if you're unsure what else they're capable of.