inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.

Read more

1. Hackrf Tools
2. How To Make Hacking Tools
3. Pentest Tools For Mac
4. Ethical Hacker Tools
5. Hacking Apps
6. Hacker Tools Mac
7. Hack Tools Download
8. Hack Tools
9. Hack Tools
10. Install Pentest Tools Ubuntu
11. Pentest Tools Linux
12. Pentest Tools Bluekeep
13. Install Pentest Tools Ubuntu
14. Hacking Tools For Windows 7
15. Pentest Tools Open Source
16. Hacking Tools Windows 10
17. Hack App
18. Hacks And Tools
19. Top Pentest Tools
20. Hacker Tools Free
21. Black Hat Hacker Tools
22. Hacking Tools For Games
23. Hack Tools Download
24. Pentest Tools For Mac
25. Hack Tools Online
26. Hacking Tools Kit
27. Hack Tool Apk No Root
28. Pentest Tools List
29. Hack Tool Apk No Root
30. Github Hacking Tools
31. Install Pentest Tools Ubuntu
32. Hack And Tools
33. Hacker Tools Github
34. World No 1 Hacker Software
35. Pentest Tools
36. Hack Tools
37. Bluetooth Hacking Tools Kali
38. Pentest Tools Framework
39. Hacking Tools Github
40. Hack App
41. Blackhat Hacker Tools
42. Pentest Tools Framework
43. Hack Tools Download
44. Hacking Apps
45. Hacker Tools For Windows
46. Bluetooth Hacking Tools Kali
47. Pentest Tools Linux
48. Hackrf Tools
49. Hacker Tools For Pc
50. Hacking Tools Github
51. Hack Tools Pc
52. Hacker Tools 2019
53. Hack Tools For Mac
54. Hacking Tools For Windows
55. Ethical Hacker Tools
56. Easy Hack Tools
57. Hacking Tools Pc
58. Hack Tools For Pc
59. Free Pentest Tools For Windows
60. Pentest Tools For Android
61. Termux Hacking Tools 2019
62. Hacking Tools 2019
63. Hacking Tools Software
64. Pentest Tools Nmap
65. Tools 4 Hack
66. Pentest Tools Website
67. Hacker
68. Beginner Hacker Tools
69. World No 1 Hacker Software
70. Hacker Tools Linux
71. Hacker Tools Windows