Once the attacker finds an exploitable vulnerability in a user program, e.g., buffer overflow. Assume his goal is to gain root privilege and typical countermeasures are not present in the system (ASLR, NX, etc.).
What are the general ways that an attacker can gain root privilege (in linux and windows)?
EDIT 1: A simple and real examples would be really helpful.