inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.


Related word

1. Termux Hacking Tools 2019
2. Pentest Tools Github
3. Hacker Tools For Windows
4. Hacker Tools 2020
5. Hacker Tools Software
6. Pentest Tools Open Source
7. Hacking Tools For Beginners
8. Hack Website Online Tool
9. Install Pentest Tools Ubuntu
10. Hacker
11. Hacking App
12. World No 1 Hacker Software
13. Hacking Tools Name
14. Hack And Tools
15. Growth Hacker Tools
16. Hacker Techniques Tools And Incident Handling
17. Hacking Tools And Software
18. What Is Hacking Tools
19. Pentest Box Tools Download
20. Pentest Box Tools Download
21. Hak5 Tools
22. Hacker Tools List
23. Best Pentesting Tools 2018
24. Hack Tool Apk
25. World No 1 Hacker Software
26. Hackers Toolbox
27. Hack App
28. Pentest Tools Website
29. Pentest Tools Apk
30. Game Hacking
31. Hacks And Tools
32. Pentest Tools For Ubuntu
33. Growth Hacker Tools
34. Hack Tools Mac
35. Tools For Hacker
36. Hack And Tools
37. Hacker Tools 2019
38. Hacker Tools Windows
39. Hack Tools For Windows
40. Tools 4 Hack
41. Hacking Tools For Games
42. Hacking Tools For Kali Linux
43. Hacker Tools 2020
44. Pentest Tools Free
45. Usb Pentest Tools
46. Pentest Tools Github
47. Hack Tools
48. Kik Hack Tools
49. Ethical Hacker Tools
50. Hack Tools For Ubuntu
51. Nsa Hack Tools Download
52. Hacking Tools Usb
53. Termux Hacking Tools 2019
54. Pentest Tools Review
55. Hacker Tools Apk Download
56. Tools Used For Hacking
57. Android Hack Tools Github
58. Hacker Tools Windows
59. Hack Tools For Windows
60. Termux Hacking Tools 2019
61. Nsa Hacker Tools
62. Hacking Tools For Games
63. New Hacker Tools
64. Hacker Tools For Pc
65. Hacker Tools Github
66. Hack Tools Pc
67. Computer Hacker
68. Hack Website Online Tool
69. Hacker Tools Mac
70. Github Hacking Tools
71. Hak5 Tools
72. Pentest Tools Url Fuzzer
73. Pentest Tools Free
74. Hacker Tools For Ios
75. Hacking Tools And Software
76. Hacking Tools Windows
77. Hacking Tools Github
78. Hacking Tools And Software
79. Blackhat Hacker Tools
80. World No 1 Hacker Software
81. Free Pentest Tools For Windows
82. New Hacker Tools
83. Pentest Tools Windows
84. Pentest Tools Review
85. How To Make Hacking Tools