If the Nmap scan does not show any promising ports then look for OS version related vulnerabilities. If that is also a dead end focus on finding misconfigured/sensitive files that could be used