Feature: ssh.checksec()

[zachriggle]

Given an active SSH connection, it Pwntools should be able to tell me about the remote system via e.g. ssh().checksec().

• Operating System
  • Only Linux is supported, only if Python is installed
  • Detect distribution and version (via /etc/lsb-release or platform.linux_distribution)
    • Notably, linux_distribution gives me Jessie on some Ubuntu systems (??)
• System-wide NX State
  • From /proc/cpuinfo
• System-wide ASLR State
  • randomize_va_space
  • mmap_rnd_bits and mmap_rnd_compat_bits
• Benign emulation checks
  • Running under qemu-system
  • Running under qemu-user
• Susceptibility to CTF tricks
  • ulimit -s unlimited ASLR bypass goes away with Linux v4.4

The checks should also be usable locally without SSH. We can do this with inspect to marshal entire functions via preexec_fn in the ssh().process(...) arguments. This way we can just execute the functions locally -- but can use them remotely.

[zachriggle]

Actually, it looks like they backported the ulimit checks to lots of kernels, and each distro did their own thing. We'll have to actually check (which is easy, just upload an ELF).