EIP-2026-102868

This Metasploit module exploits a local buffer overflow in HP System Management Homepage's setuid binary `smhstart` via the `SSL_SHARE_BASE_DIR` environment variable. It achieves privilege escalation by overwriting the return address with a `call esp` gadget and executing shellcode.