On 32-bit machines, you can disable mmap randomization (and thus library randomization) using ulimit -s unlimited.

Also, there's another useful place you can return to that isn't in libc.

ASLR is enabled, yes.

ASLR actually makes ret2libc much more difficult to pull off (esp. on 64-bit platforms), because the location of libc.so itself is randomized.