inBINcible Writeup - Golang Binary Reversing

Advertisement
This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)
The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:
-  main.main
-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 
Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"


The incoming channel will determine the final message.


Dexor and print each byte of the "Nope!" message.


This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!


Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.
This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx
This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1


(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.


Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]


Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.


Related articles


  1. Android Hack Tools Github
  2. Hack Tools For Pc
  3. Hack Tools
  4. Pentest Tools Tcp Port Scanner
  5. Pentest Tools Android
  6. Hacking Tools Download
  7. Hacking Tools Windows
  8. Pentest Tools Url Fuzzer
  9. Best Hacking Tools 2020
  10. Hacking Tools Mac
  11. Hack Tools Mac
  12. Hacking Tools For Windows Free Download
  13. Nsa Hack Tools
  14. Hacker
  15. Hacker Tools Hardware
  16. What Is Hacking Tools
  17. Hacker Tools 2020
  18. Hacker Tools For Mac
  19. Hacks And Tools
  20. Hacking Tools For Windows Free Download
  21. Pentest Tools Subdomain
  22. Hack And Tools
  23. Hacker Tools Free Download
  24. World No 1 Hacker Software
  25. Hack Tools For Windows
  26. Hackers Toolbox
  27. Hacker Tools Apk
  28. Best Pentesting Tools 2018
  29. Hack Tools
  30. Hacker Tools Free Download
  31. Pentest Tools Review
  32. Top Pentest Tools
  33. Pentest Tools Open Source
  34. Hacker
  35. Termux Hacking Tools 2019
  36. Pentest Automation Tools
  37. Hacking App
  38. Hacker Tools For Windows
  39. Best Pentesting Tools 2018
  40. Hack Tools Online
  41. Pentest Tools Github
  42. Pentest Tools Kali Linux
  43. Pentest Tools Tcp Port Scanner
  44. Hacking Tools Online
  45. Hack Tool Apk No Root
  46. What Is Hacking Tools
  47. Hacker Tools Apk Download
  48. Pentest Tools For Android
  49. What Is Hacking Tools
  50. Underground Hacker Sites
  51. Pentest Box Tools Download
  52. How To Hack
  53. Hacker Tools Software
  54. Pentest Tools Open Source
  55. Hacker Tools For Mac
  56. Hacker Tool Kit
  57. Pentest Tools List
  58. Hacking Tools Free Download
  59. Hack Tools Github
  60. Computer Hacker
  61. Hacking Tools For Windows 7
  62. Hack Tools For Pc
  63. Hacker Tools Free
  64. Hacker Tools For Pc
  65. Hacker Tools
  66. Hacker Tools Free Download
  67. Best Hacking Tools 2020
  68. Pentest Recon Tools
  69. Hack Apps
  70. Pentest Box Tools Download
  71. Pentest Tools Online
  72. Bluetooth Hacking Tools Kali
  73. Hacking Tools Free Download
  74. Pentest Recon Tools
  75. Hacking Tools For Mac
  76. Pentest Tools Github

Arsip Blog

Copyright © 2009 - - Kiamat | Coin Free Faucet Claim | Firebug Theme by Blog Oh! Blog | Converted to Blogger Template by ThemeLib.com | Jasa Promosi Online - Tukar Link Gratis