Buffer overflow - hard coded return address -

i working on project (in fact competition) exploit application running on remote server. have binaries compiled debug information (no source code) , no stack protection. managed inject shellcode onto stack , overwrite return address executed no problem.

the thing inject hard coded return address. guess there may small differences of addresses depending on operating system , architecture (should 32 bit).

i don't know if server executes binary aslr or not. deactivated - there method inject dynamic suitable return address?

i locally tried brute-force possible aslr address connecting server running on own machine. forked process crashes if return address incorrect, file descriptor not released , after 1024 tries no more connections possible. there possibility brute-force addresses?

thank you!

is there method inject dynamic suitable return address?

yes hardly depends on application, seek leaked pointer allowing compute usable addresses module base address. how aslr , dep work?

you can - assuming no aslr - identify maximum ammount of data can send remote server , setup nop sled big possible, try jumping it. increase success chances.

is there possibility brute-force addresses?

there alwyays possibility, yet don't want rely on it's probability - if 64 bits application. still paper might interest : protecting against address space layout randomization ...

have fun , luck!