In one case, I could have used tcpdump to elevate privileges on a customer's router. They had an x86 box running RHEL as their firewall/router and I was hired

In one case, I could have used tcpdump to elevate privileges on a customer's router. They had an x86 box running RHEL as their firewall/router and I was hired to resolve an (IPSec) issue they were having. I asked for a capture of some specific traffic but their I.T. guys (small company w/ only two technical staff) weren't "fluent" with bpf filters, so they created a user account for me, provided me with access via SSH, and granted me the ability to run tcpdump via sudo. From the example given, I could have used the "-z" flag to run arbitrary commands and escalate to root (although, in this case, I likely could have gained root simply by asking nicely).