server was
a001.pokemon.co.jp, which is an internal server -- accessible normally only by company VPN. but it hosted an enterprise contact form part of the website, and using a specific form of text in the email string I was able to insert commands at the end of an SSH call. Therefore I could do stuff like ls, or even create new files. I created a revshell file, used that to get shell access, then the pokecow exploit to escelate to root privileges.
From there I ran a scan for all NFS shares, and lo and behold a lovely one called /nelnet, the internal network for files
