> "Isn't it should have root/admin privieleges to do such thing?"

Privilege escalation: https://www.fuzzysecurity.com/tutorials/16.html