PermX: use CVE-2023-4220 where it fits the service, gain a shell, and escalate to root.