Anonymous FTP to root through a daisy-chain of Linux privesc classics, finishing on sudo less.

A four-hop Windows climb: SMB to RDP to AutoLogon to a service hijack, and finally SYSTEM.