Well, that would be clearer if you had a constant like `OVERFLOW_LENGTH` that then calculated the fill length by doing

```ruby
overflow_fill = OVERFLOW_LENGTH - buffer.length
buffer << rand_text_alpha_upper(overflow_fill)
```

That way the overflow will always be correct if the encoded payload were shorter than expected for some reason.  It would also let you experiment to see what is the shortest length you can use to trigger the overflow so you can send a smaller exploit.