Mallory has access to a server on the internet. She figures out she can crash it with overly long input. She guesses there is an exploitable buffer overflow. The server software is proprietary and she has no access to the executable. Can she figure out an exploit "blind", without running the server locally in a debugger?
Yes it's possible against services that restart after a crash as shown in the BROP attack described by Bittau et al (http://www.scs.stanford.edu/brop/). In this attack technique a special ROP Chain is used to write the binary from memory to the socket to simplify the construction of the shellcode.
But if this attack type is possible depends on the type of the vulnerability, the availability of gadgets and if they will be re-randomize after a crash (http://calhoun.nps.edu/bitstream/handle/10945/47979/15Dec_Keener_Lawrence.pdf?sequence=1, Chapter 6).
All together with known techniques it is sometimes possible.