EIP-2026-103022

This exploit leverages a buffer overflow in the HOME environment variable of Tower Toppler (Nebulous version 0.96) to achieve local privilege escalation (LPE) by executing shellcode that sets the GID to 20 (games). The shellcode combines a setregid(20,20) call with a standard /bin/sh spawn.