How to gain root privilege after injecting code using a buffer overflow vulnerability?

Once the attacker finds an exploitable vulnerability in a user program, e.g., buffer overflow. Assume his goal is to gain root privilege and typical countermeasures are not present in the system (ASLR, NX, etc.).

What are the general ways that an attacker can gain root privilege (in linux and windows)?