Launch a chrooted daemon that uses Meltdown to read protected memory to discover when a local console user (presumably root/sudo) logs-in, then read the protect

Launch a chrooted daemon that uses Meltdown to read protected memory to discover when a local console user (presumably root/sudo) logs-in, then read the protected memory of the keyboard input buffer (keyboard interrupt handler? Console buffer?) to grab their password, then mail() it off to your email account and login as root via SSH from the comfort of your own home.