There can be problems with server reset between exploit script execution and subsequent work under the newly added user.
But you can put both things in one shell script and execute this form of attack. In such case, the new user is created and just after that, the second part of attack is executed as soon as possible.