ssh.process -- Cannot provide empty argv

[goreil]

The following code fails:

from pwn import *
s = ssh("bandit0", "bandit.labs.overthewire.org", 2220, "bandit0")
io = s.process([""], executable="/bin/sh")
io.interactive()

Traceback (most recent call last):
  File "<string>", line 110, in <module>
ValueError: execve: argv first element cannot be empty

We expect to open the process, but instead we get an error.

Debugging

The culprit is ssh.py:1034

os.execve(exe, argv, env)

os.execve disallows empty argv[0].

Proposed solution

Instead of using os.execve, we can use ctypes to call the execve function from libc. Below is a POC to call execve in python2 (python3 works the same but strings need to be replaced with bytes)

import ctypes
# All strings need to be replaced to bytes in python3
exe = "/bin/sh"
argv = []
envp = {"A":"A"}

def get_string_list(string_list):
    #Transform a list of bytes into a ctypes array of char pointers
    char_p_array = (ctypes.c_char_p * len(string_list))()
    for i, string in enumerate(string_list):
        char_p_array[i] = ctypes.c_char_p(string)

    return char_p_array

# Transform envp from dict to list
envp = [k + "=" + v for k,v in envp.items()]

c_exe = ctypes.c_char_p(exe)
c_argv = get_string_list(argv)
c_envp = get_string_list(envp)

# Call execve
libc = ctypes.CDLL(None)
libc.execve(c_exe, c_argv, c_envp)