Nessus, surprisingly at times, often comes up with results you would never expect in both good and bad ways. Be sure you are configuring it correctly -- credentialed scans can be hard to get right.
OpenVAS has a lot of checks that Nessus does not and works in a very similar way. However, Nessus does have a ton of checks. It may be OS or environment dependent for best results, so run both.
CVEDetails is a great source, where you can narrow down into specific product, version, et al. It will often link out to other, often original resources -- or sometimes spell out a specific exploit or Metasploit module (e.g., use .*linux/gather/enum <tab>, <tab> <tab>). If it doesn't then search for the vulnerability name, CVE with number, patch number or level, or other associated information on exploitsearch.net. I grab a lot of shells or even get ideas for new privilege escalation exploits by querying these two websites daily.
Many other tools could be helpful depending on perspective. Is anything running on any local network ports? Can NeXpose or Nmap identify those ports? What about IPC or pipes? The vulscan NSE script also provides wonderful direction beyond even the default (-sC) and deeper NSE planning, configuration, and analysis. Packet analysis (e.g., pyshark provides a programmatic interface) may also be of use here. There are tons of NSE scripts for a variety of target platforms available third-party on GitHub and perhaps other places. You may need to create your own NSE scripts on occasion. Mapping known ports or services from Nmap to Metasploit is most easily accomplished with a tool or technique such as metasploitHelper.
I would caution using tools such as linuxprivchecker.py, Linux_Exploit_Suggester, linux-exp-suggester, or the various kernel exploits you find from other means. One of the primary cautions you should be aware of is SMEP. More about SMEP can be found in one of the answers on this exact forum, including how to query for it. It can be disabled at boot with a grub parameter of `nosmep' or by using an LKM. If SMEP is enabled, running kernel exploits without modification may cause a kernel panic, which means it will crash the system.
There are many ways to escalate privilege besides CVEs. Before I move on from the topic, you may find that cloning (N.B., as close as possible if you do not know all of the details) the target into your own controlled environment can allow you to run as root in order to understand your target better. Tools such as cvechecker may be incredibly useful in these cloned environments, as well as rerunning your Nessus, OpenVAS, and perhaps even CIS-CAT or ovaldi checks.
Some tools, such as LinEnum, shine whether run as root or as a less-privileged user, perhaps similarly to unix-privesc-check. I have received a lot of help from the use of these tools in a variety of environments -- cloned or owned. I have seen a few custom scripts (mostly for the PWK labs from Offensive Security) that work like these, but it is also worth it to mention unprivileged host-enumeration scripts that target hardening such as Lynis, Bastille, and LSAT / USAT. For another comprehensive list of OS-default commands, external tools, and techniques, be sure to check out -- https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
For target environments where there are password-protected root and other "live" accounts, there may be many ways to attack the identity and trust relationships in order to steal credentials. A lot of privilege escalation (and I say that this has been true over the past 50 years of computer use and abuse) is about guessing relationships (e.g., known_hosts, authorized_keys2, hosts.equiv, et al), cracking passwords (e.g., hashes), brute-forcing login, remote (e.g., ssh keys), or su/sudo prompts, etc. There are many tools that perform or aid in these tasks on Kali Linux and elsewhere. So many techniques have been developed, even in recent years. Two you should definitely be aware of are sucrack and phrasendrescher.
The key thing about passwords is reuse. If you find any file, service, or configurable on a system (or nearby system, such as on the same network -- perhaps even extending much further such as a particular user's favorite password found from an already-existing credential dump such as the Adobe, RockYou, Gawker, and others found in tools such as recon-ng) and it has a password, then you should try that password everywhere you can, especially if it makes logical sense to do so. No tool can do this for you, but many can help change things up a bit. Many just provide straight-up password recovery. Recover one password for one user and you may find a path all the way to the top. In Kali Linux, the pack project is a great starting point, with tools such as dictstat, maskgen, and policygen. John and Hashcat reign supreme, especially with integrations to other tools (e.g., metasploit-framework, LAIR-framework, KvasirSecurity), and extensions such as statsprocessor. On a network where the real action is happening, you may be able to pick up tons of cleartext, weak-encryption, or scenario-driven (i.e., MITM condition) credentials. Tools in this space are easy-creds and PCredz, perhaps even better when combined with metasploit-framework modules such as the ones under the auxiliary/server and auxiliary/spoof hierarchies. Credentials can also be acquired via social engineering techniques -- let's not forget the basics with tools such as SET, et al.
