I am pretty sure hsploit didn't work for me There is the other tool, the amusingly named HyperFuck That did it in one, I remember being surprised at the ease