10+ years ago I was setting up a new web server, Apache running on a Linux box.
I was not in the sysadmin team, I was in the web team, so I was not allowed root access, even though the box belonged to the web team.
I asked for root access (via sudo) so I could do stuff like restart Apache.
The manager of the sysadmin team said no way was I getting full access to root, but I could get sudo to run specific commands.
So one of the sysadmins wrote a helper script to do the things I needed, and I could use sudo to run that script (and that script alone) as root.
I told him, it wasn't secure, I could use his helper script to get full root access. He challenged me to prove it.
So I wrote a program which dropped a setuid root shell in my home directory. I used the CustomLog directive in Apache to pipe Apache's logs to that program. Then I used his helper script to restart Apache.
When Apache started, it ran my program as root. I then used the setuid binary it had dropped to become root, and created a file in the sysadmin's home directory to prove it.
When I showed this to the sysadmin, he decided to abandon the helper script. Instead, he just told me the root password.
I was not in the sysadmin team, I was in the web team, so I was not allowed root access, even though the box belonged to the web team.
I asked for root access (via sudo) so I could do stuff like restart Apache.
The manager of the sysadmin team said no way was I getting full access to root, but I could get sudo to run specific commands.
So one of the sysadmins wrote a helper script to do the things I needed, and I could use sudo to run that script (and that script alone) as root.
I told him, it wasn't secure, I could use his helper script to get full root access. He challenged me to prove it.
So I wrote a program which dropped a setuid root shell in my home directory. I used the CustomLog directive in Apache to pipe Apache's logs to that program. Then I used his helper script to restart Apache.
When Apache started, it ran my program as root. I then used the setuid binary it had dropped to become root, and created a file in the sysadmin's home directory to prove it.
When I showed this to the sysadmin, he decided to abandon the helper script. Instead, he just told me the root password.