This is one of the things while technically possible, is virtual impossible without years of development because it's not just getting root, you have to go exploit code IN the kernel and overwrite pages in the kernel and that is very very very hard to do across multiple OS versions. The only way you could possibly do it is writing your own bootloader virus which loads itself and then windows and would have Ring 0 that way, those are very hard to write though and with Windows 8 "Secure UEFI" will be practically impossible for most people.
