There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the context of root.
nmap can be started in interactive mode as shown below:
nmap --interactive
However, in more recent versions of nmap, the interactive option is not available.
So, is it still possible to access the shell through nmap and execute shell commands in the context of root if the suid bit is set?
I came across this post: https://seclists.org/nmap-dev/2010/q1/1241
It states when the "--interactive" option for nmap was removed.
Note, even in the most recent version of nmap, it displays a warning message when its started and if the suid bit is set:
$ nmap -v
Starting Nmap 7.01 ( https://nmap.org ) at 2019-04-25 06:04 UTC
WARNING: Running Nmap setuid, as you are doing, is a major security risk.