paramiko_su.py

import paramiko

client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect('localhost', username='inndy', password='12341234')

shell = client.invoke_shell(environment={'LC_ALL': 'en_US.UTF-8', 'LANG': '', 'LANGUAGE': ''})
print('[*] first shell data')
print(shell.recv(4096))
print('-'*80)

print('[+] exec /bin/sh')
shell.send('exec /bin/sh\nexport LANG=\nexport LANGUAGE=\n')

def wait_for(socket, signature):
    data = socket.recv(4096)
    while signature not in data:
        data += socket.recv(4096)

    return data

print(wait_for(shell, b'$ $ $ '))

print('[+] su')
shell.send('su\n')
print(wait_for(shell, b'Password: '))

print('[+] input password')
shell.send('567567\n')
print(wait_for(shell, b'# '))

shell.send('whoami; echo UID=$UID; echo Am I root now?\n')
print(wait_for(shell, b'Am I root now?'))