We can't overflow the RIP directly this time, but we can use an off-by-one overflow to overwrite the least significant byte of the RBP. If we point the RBP to an address in the buffer we control, we can force it to jump to our shellcode, when the calling function leaves.

Full video walkthrough: https://www.youtube.com/watch?v=jU7yB-elFV8