You don't need eip control for every pwn.
Service : nc 68.183.158.95 8990

Original writeup (https://github.com/r4j1337/ctf-writeups/tree/master/hackcon2019/pwn/babypwn).