I remember at uni we used to use the forth boot prompt to hack root on the Sun workstations at uni; you could type it all out on one line. You had to search for the symbol table and then jump through some hoops to find the kernel task list, find the pid of your shell process, edit the user struct and set the effective uid to zero.