Escalate through weak service permissions and unquoted paths
A service you can reconfigure, or one whose unquoted path runs through a writable directory, executes your binary as its account on restart.
Tag: misconfiguration
Plant a root SUID over an NFS no_root_squash export
When an export is shared with no_root_squash, a SUID binary you create as root on your own box stays root-owned on the server.
Reflected CORS with credentials for data theft
An origin-reflecting ACAO plus allow-credentials lets any site read authenticated API responses in the victim's browser.