Lazy

nmap

Samba is running on ports 139 and 445 with version 3.6.25

It turns out Samba 3.6.25 is vulnerable to this Metasploit module.

Exploitation

Open msfconsole

Search for is_known_pipeline exploit and use that exploit.

Set rhost and run the exploit

set rhost 172.31.1.1
run

Now you got a root shell.

Thanks and enjoy the rest of your day! :D