Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname).
However, it means I can read and write at arbitrary virtual memory addresses. I know the python interpreter is statically linked so it has no external shared object dependencies.
While nx is enabled, strangely aslr seems to be disabled.
I already identified and dumped the following region whose contents and places never change :
0x00010000:0x00050000 # read only and executable 0x01000000:0x01b80000 # read only and executable 0x11000000:0x1158c000 # writable # The heap is located between those 2 places and it’s location is chose at random 0xfe500000:0xffffffff # writable
In that case, is it possible to rebuild the ᴇʟꜰ binary ? (it was compiled for native client). It doesn’t have to be the original binary with the original header, but just an executable that can be launched from the various parsed ᴇʟꜰ segments.
Unlike normal nexe, the python.nexe is compiled
nacl_interp can only be ran on Linux. This mean the target ᴏꜱ in the ᴇʟꜰ header is set to 0x7B (whereas normal nexe are ᴏꜱ independent).
The libc is glibc. See also https://groups.google.com/forum/#!topic/native-client-discuss/t54RajuGnPc