Bypassing ASLR without leak address

Question

I have found a stack buffer overflow.

Currently this is the situation: No DEP ,ASLR on everything except the binary itself.

I am able to override the returns a