Once the attacker finds an exploitable vulnerability in a user program, e.g., buffer overflow. Assume his goal is to gain root privilege and typical countermeasures are not present in the system (ASLR, NX, etc.).
What are the general ways that an attacker can gain root privilege (in linux and windows)?
EDIT 1: A simple and real examples would be really helpful.
There are many ways to get to root. You need to consider exploits which get you root, as well as those which get you access at a lower privilege in conjunction with a privilege escalation exploit.
Generally what you need is an exploit in a service run as root, or another privileged account.
As cremefraiche noted, you should have a good read of cve.mitre.org to get some idea of the variety.
I think in real world case, the attacker would package a new vulnerability into a tool like Metasploit.
That tool provides a full framework for gaining a presence on the target host and then escalating privileges.
One way to gain the root privilege in Linux is to exploit a vulnerability in a set-root-uid program. Basically, a set-root-uid program allows an unprivileged user to do some tasks with the root privilege. An example of a set-root-uid program is the passwd program for password management. You can find a simple example with step-by step guidance of exploiting set-root-uid program to gain root privilege at here:
http://www.cis.syr.edu/~wedu/seed/Labs_12.04/Vulnerability/Buffer_Overflow/
