Comment by vortico

I've always considered root escalations to be pretty minor because you can just launch a phishing attack by adding the following to the user's .bashrc.

    alias sudo='sudo ./badscript; sudo'

Most Linux/Mac installations are single user anyway, so you can steal the user's private information without even gaining root.