- Inject into a root process with cap_sys_ptrace A shell or binary holding cap_sys_ptrace can attach to a root-owned process and hijack it to run your shellcode as root.
- Abuse sudo LD_PRELOAD and LD_LIBRARY_PATH If sudoers preserves LD_PRELOAD or LD_LIBRARY_PATH, any command you are allowed to run as root loads your shared object first.
- Plant a root SUID over an NFS no_root_squash export When an export is shared with no_root_squash, a SUID binary you create as root on your own box stays root-owned on the server.
- Hijack a writable or PATH-relative systemd unit A root-run service with a writable unit file or a relative ExecStart lets an unprivileged user execute code as root on the next start.
- Break out of a container through the Docker socket A mounted or reachable docker.sock is root on the host, because you can start a container that bind-mounts the host filesystem.
- Root via pkexec argument confusion (PwnKit) A memory-corruption flaw in the SUID pkexec turns any local account into root on unpatched polkit installations.
- Escalate through Linux file capabilities A binary carrying cap_setuid or cap_dac_read_search grants root-equivalent power without any SUID bit, and defenders rarely audit it.
- Check GTFOBins before giving up on a binary A boring binary with the wrong sudo rule or SUID bit is often a shell in disguise.