Had great fun with the SPV command, used that to code up a keylogger. Was able to pull up a spoof login screen on all the terminals using that and able to pass off input as commands and the end user would be none the wiser.
Other great find was that back then discs were big and expensive and not as reliable, so they rotated the discs to even out the wear. They also didn't fully erase them and if you created a file, you had to specify to zero it as an option. This allowed you to create a file, dump the contents and read what was previously upon the discs. Now as the operator console would create a journal log of everything typed (including login and password - everything typed) and factoring in disc rotation, then it was possible as a user to create files upon what was a disc previously used for console journal logging and read the contents. This yielded the username and password of the system admin at college and even today recall that wonderful admin/5588 username and password.
Fun times indeed.