inBINcible Writeup - Golang Binary Reversing

Posted by iNoticiero on viernes, 28 de agosto de 2020 0

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)
The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:
-  main.main
-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 
Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"


The incoming channel will determine the final message.


Dexor and print each byte of the "Nope!" message.


This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!


Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.
This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx
This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1


(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.


Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]


Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.


More info


  1. Ethical Hacker Tools
  2. Pentest Tools Find Subdomains
  3. How To Install Pentest Tools In Ubuntu
  4. Hacker Tools Apk Download
  5. What Are Hacking Tools
  6. Physical Pentest Tools
  7. Hacking Tools Usb
  8. Hacker
  9. Hackrf Tools
  10. Hacking Tools Windows 10
  11. Best Pentesting Tools 2018
  12. Pentest Tools Windows
  13. Best Pentesting Tools 2018
  14. Hacking Tools For Beginners
  15. Pentest Tools Online
  16. Hackers Toolbox
  17. Hacking Tools Windows 10
  18. Top Pentest Tools
  19. Growth Hacker Tools
  20. Hacking Tools Mac
  21. Hack Tool Apk No Root
  22. Hackrf Tools
  23. Pentest Tools Online
  24. Hack Tools For Pc
  25. Hack Tools For Mac
  26. Kik Hack Tools
  27. Free Pentest Tools For Windows
  28. Hacker Tools Software
  29. Hack Tools Online
  30. Install Pentest Tools Ubuntu
  31. Android Hack Tools Github
  32. Hack Website Online Tool
  33. Android Hack Tools Github
  34. Hack Tools Mac
  35. Pentest Tools Tcp Port Scanner
  36. Pentest Tools Online
  37. Pentest Recon Tools
  38. Pentest Tools Linux
  39. Hacker Tools 2020
  40. Hack Tools For Games
  41. What Is Hacking Tools
  42. World No 1 Hacker Software
  43. Hacker Search Tools
  44. Black Hat Hacker Tools
  45. Hacker Tools Apk
  46. Pentest Tools Subdomain
  47. Pentest Tools Free
  48. Computer Hacker
  49. Hacking Tools For Windows 7
  50. Pentest Tools For Android
  51. Hacking App
  52. Hacker Tools Online
  53. Hackers Toolbox
  54. Hacking Tools Mac
  55. Tools Used For Hacking

Tagged as:
About the Author

Write admin description here..

Get Updates

Subscribe to our e-mail newsletter to receive updates.

Share This Post

Related posts

0 comentarios:

What they says

© 2013 ECOLOGÍA. WP Theme-junkie converted by BloggerTheme9
Blogger templates. Proudly Powered by Blogger.
back to top