Do I always have to overwrite EIP to get to write on the stack in a buffer overflow? How's the memory organized? I can't find a proper graph with google
You don't always have to overwrite the return address in order to exploit a stack based buffer overflow (also has a great diagram of the stack layout). With a stack based buffer overflow you can corrupt other variables declared in the local scope of the function which can produce interesting results.
For instance lets say there is an authentication funcation:
The stack layout is such that
In this buffer overflow vulnerability, the use of: ASLR, NX Zones, and Stack Canaries does not prevent exploitation. In fact it is also likely that the same exact exploit will work regardless of platform (windows/linux/arm/x86...).
(Disclaimer: I think I read about this exploitation method in "Hacking: The Art of Exploitation")
That's the other way round: you overflow a stack buffer so that you get to overwrite the field with which EIP will be loaded when the function returns.
In usual architectures, the stack grows downwards, so that the "return address" pushed on the stack when the function was called lies a few bytes after the local variables. By overflowing a local buffer, you get to overwrite what lies after in RAM, i.e. the return address. When the function returns, the corresponding