I plan to do this one soon. As far as I know, you would overwrite the GOT entry with an address to something, not the thing itself (shellcode). If you can point back to your shellcode somewhere, that ought to work. Otherwise, you’d need some ROP chaining based on code and functions already in the binary, or libc if you leaked the libc version.