So, suppose that someone obtained a shell of a remote machine (of course via Internet). But the (linux) shell is under www user. Would there be any way of trying privilege escalation?
Yes. The top two methods of privilege escalation are:
(There are other methods of privilege escalation, such as exploiting a race condition in the way that a program running as root uses the filesystem, or vulnerabilities in a system service/daemon. However, my impression is that those are a bit less common.)
My rough rule of thumb is: if an attacker has access to a non-root account on your machine, you should assume that if they are sufficiently dedicated and sophisticated, be prepared that they may be able to get root on your machine. It's not a sure thing, to be sure -- but reliably stopping privilege escalation is difficult, when the attacker has access to a user account on your system.
If this sounds abstract, let me make it more concrete for you. You know how, for most smartphones, you can go on the Internet and find a way to root or jailbreak your phone? Well, guess what -- when you run some program to "root" your phone, under the covers it works by exploiting some privilege escalation vulnerability in your phone. Tools for rooting your phone have one or more such privilege-escalation exploits baked into them, and there is a phone enthusiast community that avidly looks for and collects such vulnerabilities. Empirically, most phones can be rooted -- in other words, most phones have at least one such vulnerability. The prevalence of such vulnerabilities gives you some idea of the difficulty of reliably preventing privilege escalation.