TwoMillion: use CVE-2023-0386 where it fits the service, gain a shell, and escalate to root.