GreenHorn: use CVE-2023-50564 where it fits the service, gain a shell, and escalate to root.