VulnServer and EIP

2018-10-22 20:57:34

I am practicing basic stack exploitation with VulnServer and I am having some problems putting JMP ESP address on EIP.

It is quite strange, because I am able to put 4 'B' on EIP (or any other address), have found one JMP ESP on 625011AF but the server behaves strangely with the byte "\x62".

I can put 635011AF:

I can also put 615011AF:

But with the proper JMP ESP address, the EIP is not overwritten:

Any idea what may be wrong? All the "JMP ESP" found with mona start with \x62 :\