Noz2 / RootHound Map your path from a low-priv user to roo, like BloodHound, for local Linux privesc.