This tutorial shows how to find a JMP ESP in nttdll.dll
http://sh3llc0d3r.com/vulnserver-trun-command-buffer-overflow-exploit/
Find