The user li504 managed to get screen to run under root uid
m-net% ps waux | grep li504
nhard0n 16813 0.0 0.2 3764 2380 pc LNL+ 7:24PM 0:00.00 grep li504 (zsh)
li504 2704 0.0 0.2 3244 1976 pi INs+ Mon08AM 0:00.24 /bin/bash
li504 2588 0.0 0.2 3248 1980 pk INs Mon08AM 0:00.26 /bin/bash
li504 2920 0.0 0.2 2060 1568 pk SN+ Mon08AM 0:02.12 screen -dr 2702
li504 2705 0.0 0.2 3244 1976 pp INs+ Mon08AM 0:00.23 /bin/bash
li504 2761 0.0 0.2 3244 1976 pv INs Mon08AM 0:00.32 /bin/bash
li504 2806 0.0 0.1 2060 1540 pv SN+ Mon08AM 0:02.08 screen -dr 2586m-net% ps waux | grep 2702
root 2702 44.3 0.2 2100 1648 ?? RNs Mon08AM 3214:53.34 screen
nhard0n 16858 0.0 0.2 3764 2380 pc LNL+ 7:25PM 0:00.00 grep 2702 (zsh)
li504 2920 0.0 0.2 2060 1568 pk SN+ Mon08AM 0:02.12 screen -dr 2702He is a regular user.m-net% ps waux | grep 2586
root 2586 39.5 0.2 2128 1676 ?? SNs Mon08AM 3213:32.88 screen
li504 2806 0.0 0.1 2060 1540 pv SN+ Mon08AM 0:02.08 screen -dr 2586
How did he or she do this?m-net% id li504
uid=46665(li504) gid=10(guest) groups=10(guest)