By exploiting a root escalation.

Or just finding a file/dir you forgot to set a tight enough mode on (happens a lot in systems where the default is insecure).