You will do little or no damage to the OS without root privileges.
Not a problem. I've broken root on an HP workstation in under 5 minutes. There's always another hole. In the case of the HP workstation, the sysadmin had gone on vacation for 3 weeks and left nobody with the root password. I exploited a setuid program that made a "system()" call to manufacture a copy of /bin/sh that was setuid to root. I changed the root passwd, handed that to the designated admin and removed the "hack" tool.