ssh_process.elf can return incorrect ELF, when ssh_process.executable is included in the ssh cache path

[cpupower]

When getting the target process' ELF using the ssh_process.elf property, a wrong ELF is returned, when the path of the target binary on the remote system is included in the path of the local cache:

Example:
target.libs() returns:

{'/somepath/target/target1/somehost.org/lib32/libc.so.6': 4158791680, 
 '/somepath/target/target1/somehost.org/target/target1': 0, 
 '/somepath/target/target1/somehost.org/lib/ld-linux.so.2': 4160602112}

while target.executable is /target/target1.
So /target/target1 is included in the cache path.

Therefore the condition evaluates to true (just checks whether the string is contained):

pwntools/pwnlib/tubes/ssh.py

Lines 343 to 345 in df7c1fe

	for lib in libs:
	if self.executable in lib:
	return pwnlib.elf.elf.ELF(lib)

Maybe the condition should check

lib.endswith(self.executable)

instead. However I am not 100% sure, whether this covers all cases.

[zachriggle]

Good catch!

I'm not sure how to resolve this perfectly, since it's also possible for a binary to rely on another ELF with the same basename. In the meantime, using basename is probably as good as we can do -- would you mind submitting a pull request? ❤️

Thanks!