Say you find a script that you can run as another user, and it executes a system command based on your input. There’s a privesc opportunity there. Besides the usual things such as ‘&’, ‘|’, and ‘;’ what are other ways to include another command for privesc?
Maybe $(whoami) or `whoami` can work. It can give you an error, but that command is executed before the ‘full command’