Inject into a root process with cap_sys_ptrace

A shell or binary holding cap_sys_ptrace can attach to a root-owned process and hijack it to run your shellcode as root.