Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as they require a bit of Assembly knowledge though there are some great websites that can help you out.
1. Employ an Egg Hunter. An egg hunter involves sticking a small bit of a shell code in a limited buffer space and then prepending a 8 byte egg (ie n00bn00b) before your shell code. The egg hunter will search through memory for your unique egg and then jump to the shell code that follows it.
Example buffer Variable
buffer = "\x41" *100 + "n00bn00b" + shellcode + "\x90" * 50 + egghunter + offset + jmpback
Where above "offset" could be a simple
JMP ESP in a DLL and "jmpback" would be an assembly instruction to jump back into the buffer to somewhere in the nopslide.
While it looks a bit confusing the execution flow is as follows
offset variable is placed where your EIP overwrite is. This variable simply holds the address to a
JMP ESP instruction which then points to the
jmpback variable holds an assembly instruction (ie
\xeb\xc4) which jumps back into the nopsled.
The egghunter shellcode runs and begins searching for the n00bn00b string.
When the n00bn00b string is found it jumps to the shellcode which executes.
The Egghunter is a great way to give yourself some more buffer space.
2. Jumping backwards into the buffer : The second option, if the buffer space is available to you, is to issue some assembly instructions to jump further back into the buffer to execute your shell code. This sounds like the easier of the two options, however it's possible to trash the stack if you're not careful to re-align the stack after shell code execution.
If you have a clean overwrite of another register, such as ECX, it might even be possible to just
JMP ECX to fire your shell code.
Note that this answer assumes that things like DEP and ASLR are not enabled on the machine you're attempting to exploit.