The goal here is to make eip
point to your shellcode. There are many ways to do that. The first thing would be to check if your shellcode is placed in a register. If that happens then you can perform a ret2reg (return to register) by finding a gadget that will let you return to that register (like call reg
etc...). Another way would be to use a nopsled - but that is not that stable. In that case your payload could be like:
nops + shellcode + (1040 -len(nops+shellcode))*"A" + pack32(a_nop_address)
Have in mind though, that the "a_nop_address" from the above payload changes inside gdb
and will not be stable in case aslr
is enabled. All the above ways assume that your stack is executable of course. Another way is also to use a shell variable that will contain your shellcode and then make eip
point to that address. Finally, there are also more advanced methods, like ret2libc, ret2plt, ROP etc..., that do not even use a shellcode to pop a shell and can also help to bypass some security mitigations like aslr and non-executable stack.