The goal here is to make
eip point to your shellcode. There are many ways to do that. The first thing would be to check if your shellcode is placed in a register. If that happens then you can perform a ret2reg (return to register) by finding a gadget that will let you return to that register (like
call reg etc...). Another way would be to use a nopsled - but that is not that stable. In that case your payload could be like:
nops + shellcode + (1040 -len(nops+shellcode))*"A" + pack32(a_nop_address)
Have in mind though, that the "a_nop_address" from the above payload changes inside
gdb and will not be stable in case
aslr is enabled. All the above ways assume that your stack is executable of course. Another way is also to use a shell variable that will contain your shellcode and then make
eip point to that address. Finally, there are also more advanced methods, like ret2libc, ret2plt, ROP etc..., that do not even use a shellcode to pop a shell and can also help to bypass some security mitigations like aslr and non-executable stack.