inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.

Continue reading

1. Hacking Tools For Windows Free Download
2. Hack Tools Download
3. Pentest Tools Alternative
4. Top Pentest Tools
5. How To Install Pentest Tools In Ubuntu
6. Easy Hack Tools
7. Hacking Tools 2019
8. Hack Tools Online
9. Pentest Tools Nmap
10. Pentest Tools Website Vulnerability
11. Hack Tools 2019
12. Black Hat Hacker Tools
13. Hacker Search Tools
14. Hack And Tools
15. Nsa Hacker Tools
16. Hacker Tools For Mac
17. Hack Tools 2019
18. Hack Tools Mac
19. Hacker Security Tools
20. Usb Pentest Tools
21. Bluetooth Hacking Tools Kali
22. Pentest Tools Alternative
23. Hack Tools For Games
24. Bluetooth Hacking Tools Kali
25. Pentest Tools Bluekeep
26. Nsa Hack Tools
27. Free Pentest Tools For Windows
28. New Hacker Tools
29. Hacks And Tools
30. Hacker Tools Software
31. Hacking App
32. Pentest Tools Website Vulnerability
33. Hack Tools 2019
34. Underground Hacker Sites
35. Hacking Tools Download
36. How To Install Pentest Tools In Ubuntu
37. Hack Tools For Pc
38. Pentest Tools Framework
39. New Hack Tools
40. Top Pentest Tools
41. Hacker Security Tools
42. Physical Pentest Tools
43. Hacker Tools Windows
44. Beginner Hacker Tools
45. Free Pentest Tools For Windows
46. Pentest Tools List
47. Black Hat Hacker Tools
48. Pentest Tools Website Vulnerability
49. Hack Tools
50. Hack Tools For Games
51. Hacker Tools Free Download
52. Hack Website Online Tool
53. How To Make Hacking Tools
54. Best Hacking Tools 2019
55. Hacking Tools For Kali Linux
56. Hack Tools 2019
57. Hack Tools For Ubuntu
58. Hacker Tools Apk Download
59. Pentest Tools Download
60. Hacking Tools Kit
61. Hacker Tools
62. Hacker Tools For Windows
63. Best Hacking Tools 2019
64. Best Pentesting Tools 2018
65. Hackers Toolbox
66. Hacking Tools For Kali Linux
67. Hack Apps
68. Hacking Tools Download
69. Hack Tools Mac
70. Hacking Tools Name
71. Hack Tools Github
72. Hacking Tools Windows
73. Hack App
74. Hack Tools For Windows
75. Hacker Tools For Pc
76. Nsa Hack Tools Download
77. Pentest Tools Windows
78. Hacker Tools Github
79. Hacking Tools For Pc
80. Pentest Box Tools Download
81. Hack App
82. Pentest Tools Github
83. Pentest Tools Framework