Let's suppose a scenario of a Unix-like system (like macOs, linux, solaris etc.) having installed a program from the internet that's been developed by a malicious actor.
The program does not use any zero day exploits on the system to escalate privileges. It simply runs within the context of a regular non-administrative user, with all its restrictions. It records all keypresses in the background until it records the user typing into a terminal "su" followed by a password. This program, suddenly, captures the password of the root user.
My question is, having this password captured, can the program relaunch itself from the context of the root user or even escalate its privileges while still running, doing all this without the current user noticing? What utilities do exist that will allow such a program to do such a thing? I'm talking about an ideal scenario in which no bugs or exploits in the kernel are used whatsoever. I'm simply talking about a program simply using existing system utilities in ways that they were already intended to be used.