got a shell with CVE
sudo -l Matching Defaults entries for zabbix on unrested: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin, use_pty
User zabbix may run the following commands on unrested: (ALL : ALL) NOPASSWD: /usr/bin/nmap *
can run nmap
so nmap can run as root
script and interactive modes are disabled
—datadir option I was able to get a shell as root