1. Leak canary2. Overwrite ret addr with ROP chain3. In the ROP chain:*   Set global value stack_prot to 7* 	Call dl_make_stack_exec with libc_stack_end as argument to make stack executable (ref: http://radare.today/posts/defeating-baby_rop-with-radare2/ )* 	Call read again to read execve /bin/sh shellcode onto the stack4. ret to the shellcode5.  Send 'exit\n' to cause ROP chain to be executed