Why are you using %00 at the end of your input? You're getting it "free" :) from the code itself in the . ".php" part
I'm guessing that the challenge is not in PHP7, since you can't terminate strings like that any more.
Anyway, using the payload ../etc/config (without null - %00) works for me:
However, maybe my setup is wrong:
Correction.. I’ll look again but in order to overwrite EIP you’d need to input a buffer that is buf +whateverIsAboveItOnStack + EBP (4bytes) + whateverYouWantEIPtoBe . Run the program in gdb and type disass strcpy() the you’ll be able to see where the overflow happens and where your buffers are located. Hope this helps.
(gdb) run $(python -c 'print "a" *...