Step 5: Finding the Right Module

JMP ESP

Find a JMP ESP gadget using Mona:

!mona jmp -r esp -cpb "<badchars>"

Go to "Log" by pressing Alt+L. Mona finds 9 gadgets and we can pick any gadget in this case:

JMP ESP