Reading OS API docs for fun and profit
I remember reading the Novell APIs and discovering that if you were a print server, you could ask for owner rights on a file, so that you could access and print that file.
Unfortunately, if that owner was SUPERVISOR (Novell's version of root) then you also got supervisor rights.
And you could be a print server simply by advertising as one! So if a supervisor tried to print, then you could ask for rights on the file, become supervisor, then say you couldn't print the file anyway, so it went back in the queue and was printed by the real print server, with no one the wiser.
I also discovered that when you advertised as something, you got put in the bindery (a sort of object registry) of all the fileservers on the network.
Hmmm. What if I advertise as type "user" then I should be put in as a user for all the servers!
Well, you do!! Plus since it's the fileserver putting the object in, and FILESERVER > SUPERVISOR, then the other supervisors see this new user, go "huh?", try to delete it, and CAN'T.
Result: A bunch of pissed off fellow supervisors whom you now owe beers!!