Bypassing ASLR without leak address

I have found a stack buffer overflow.

Currently this is the situation:

• NX/DEP disabled
• ASLR enabled
• Not a PIE

I am able to override the return address and jump to PLT sections.

My problem is that I can only copy data until the return address because of the null byte, therefore I can not jump to my shellcode in the stack. The binary starts in 0x00090000 so it is a problem to perform ROP gadget since I can copy only one address until the return address.

Also, my binary contains a call to system that I can jump to, but in this case I need to put the address of the string argument in R0, but this is not possible due to the ASLR. I am also able to override 4 registers.

Does anyone have an idea how to bypass the ASLR here without leaking an address? Current architecture: ARM