Shocker: use CVE-2014-6271 where it fits the service, gain a shell, and escalate to root.