inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.


Related word

1. Tools Used For Hacking
2. Hacker Tools List
3. Nsa Hack Tools
4. Best Hacking Tools 2019
5. Pentest Tools Github
6. Install Pentest Tools Ubuntu
7. Hacker Search Tools
8. Hack Tools 2019
9. Pentest Tools For Ubuntu
10. Pentest Recon Tools
11. Termux Hacking Tools 2019
12. Top Pentest Tools
13. Pentest Tools Subdomain
14. What Is Hacking Tools
15. Hacking Tools 2019
16. Hacking Tools For Mac
17. Pentest Tools Open Source
18. Hack Rom Tools
19. Hacker Tools Github
20. Pentest Tools Nmap
21. Pentest Tools
22. Hacking Tools For Windows 7
23. Hacker Tools For Windows
24. Pentest Tools For Ubuntu
25. Hacking Tools Online
26. Hacking Tools For Kali Linux
27. Top Pentest Tools
28. Hacker Tools Windows
29. Hack Tools For Windows
30. Hacking Tools Mac
31. Underground Hacker Sites
32. Hacker Tools Mac
33. Pentest Tools Website
34. Hacker Tools Free
35. Hack Website Online Tool
36. Pentest Tools Github
37. Hacker Hardware Tools
38. Pentest Tools Website Vulnerability
39. What Is Hacking Tools
40. New Hack Tools
41. Bluetooth Hacking Tools Kali
42. Hacking Apps
43. Hack App
44. Pentest Tools Windows
45. Hacker Search Tools
46. Pentest Tools Website
47. Pentest Tools Url Fuzzer
48. Hacker Tools Hardware
49. Hack Tools
50. Hacker Tools Windows
51. How To Make Hacking Tools
52. Nsa Hack Tools
53. Pentest Tools For Windows
54. Hacking Tools Mac
55. Best Pentesting Tools 2018
56. Hacker Tools For Pc
57. Hack Tools
58. Hacker Tools For Ios
59. Hacking Tools Mac
60. Hacking App
61. How To Hack
62. How To Make Hacking Tools
63. Nsa Hacker Tools
64. Pentest Tools Find Subdomains
65. Hack Tools Download
66. Pentest Tools Website
67. Hacks And Tools
68. Hacker Tools Free
69. Hacking App
70. Hacking Tools For Mac
71. Hacker Tools Apk Download
72. Ethical Hacker Tools
73. Pentest Tools Bluekeep
74. Best Pentesting Tools 2018
75. Pentest Tools Open Source
76. Android Hack Tools Github
77. Hack Website Online Tool
78. Hacking Tools Hardware