In high school, almost all the IT work was done by the students who were trusted by the computer class teacher. That trust was often used to facilitate light-hearted mischief.

A colleague of mine developed and infected every student-accessible computer with a remote-access tool listening over a TCP socket. We'd mostly use it to open and close CD trays. Another colleague was unsatisfied by how the TCP approach made the CD trays go off one-by-one if you tried the batch mode, so he wrote another remote-access tool, this time masquerading as a Windows service, and listening over UDP. Then he'd use UDP broadcast to simultaneously open and close CD trays everywhere in school.

Fun times.

Oh, and one of the first things they did to me when I was getting to know them was installing and hiding simple PHP script in my WWW folder on my account on school server. The script would basically evaluate its input param in backticks. That is, a minimal remote shell accessible in my public folder. AFAIR it took me couple of months to track down why some weird things were happening to my account from time to time.