Ok, I’m in a remote situation where I don’t have access to the remote filesystem but where I can run arbitrary python code (except I can’t fork processes and I don’t have access to ulimit and uname).
However, it means I can read and write at arbitrary virtual memory addresses. I know the python interpreter is statically linked so it has no external shared object dependencies.
While nx is enabled, strangely aslr seems to be disabled.
I already identified and dumped the following region whose contents and places never change :
0x00010000:0x00050000 # read only and executable
0x01000000:0x01b80000 # read only and executable
0x11000000:0x1158c000 # writable
# The heap is located between those 2 places and it’s location is chose at random
0xfe500000:0xffffffff # writable
In that case, is it possible to rebuild the ᴇʟꜰ binary ? (it was compiled for native client). It doesn’t have to be the original binary with the original header, but just an executable that can be launched from the various parsed ᴇʟꜰ segments.
Update :
Unlike normal nexe, the python.nexe is compiled nacl_interp
can only be ran on Linux. This mean the target ᴏꜱ in the ᴇʟꜰ header is set to 0x7B (whereas normal nexe are ᴏꜱ independent).
The libc is glibc. See also https://groups.google.com/forum/#!topic/native-client-discuss/t54RajuGnPc
python 2.7.5
.