In famous buffer overflow tutorial by Corelan Team (part 2) a technique called "blind return" is mentioned.
So if you overwrite EIP with the address that will perform a RET instruction, you will load the value stored at ESP into EIP.
and further down
Overwrite EIP with an address pointing to a ret instruction
Hardcode the address of the shellcode at the first 4 bytes of ESP
I don't get the advantage of this approach. You need to hardcode the address XXXX at the start of the shellcode (ESP). Wouldn't it be easier just to overwrite EIP with XXXX directly to get the same effect?