There's a myriad of ways, depending on the system configuration and installed software. Learn what you can about the system, and then look for publicly-known "privilege escalation" vulnerabilities in the OS and installed software. Make sure to check for the specific versions that are installed, as most known vulnerabilities will likely have been patched in the latest versions.
Depending on the scope and rules of engagement for your test, you could also try to trick System Administrators into installing keyloggers onto their own systems and capture the root password that way. Or, just dump the shadow file and run it through a cracking utility - if you're lucky, they're using a weak enough root password that you can break it in a reasonable amount of time and elevate yourself that way.
If you have the shadow file, believe it or not, Google can also be a useful resource. Drop the password hash into a Google search and see if anyone's posted the matching cleartext online.
Also be aware that BIOS policy alone is not enough. BIOS settings can often be reset through trivial means, or you could remove the hard drive from the system and attach it to your own computer for full access. Whole-disk encryption is the only effective countermeasure against this, but if you're assuming the attacker is an authorized user of the system, then the attacker also has the keys to decrypt the drive on a separate system with the right software.
