Here's the scenario, part of a wargame/CTF type exercise. There is a vulnerable program running as a service on the remote host. I have access to a copy of the binary, which has a stack overflow from an unchecked scanf.
I am able to trigger the overflow and execute code, but I'm having trouble figuring out what to use for the return address. If I run the binary on my test machine, I can successfully get a shell only if I know roughly the address of my shellcode on the stack. At the time of the overflow, none of the registers contain the location of the shellcode. My thought was that I should be able to brute force the return address, but that hasn't been working on either my test instance (ASLR disabled) or the remote service (ASLR status unknown).