inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)

The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:

-  main.main

-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 

Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"

The incoming channel will determine the final message.

Dexor and print each byte of the "Nope!" message.

This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!

Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.

This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx

This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1

(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.

Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]

Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.


More information

1. Hacking Tools Free Download
2. Hacking Tools Windows 10
3. Install Pentest Tools Ubuntu
4. Hacking Tools For Pc
5. Kik Hack Tools
6. Hacking Tools Mac
7. Hacker Tools Free Download
8. Android Hack Tools Github
9. Hack Tools For Ubuntu
10. Pentest Tools Download
11. Pentest Tools Online
12. Free Pentest Tools For Windows
13. How To Make Hacking Tools
14. Hack Tool Apk
15. Hacking Tools Windows
16. Hacker Tools For Ios
17. Hacker Tools For Pc
18. Github Hacking Tools
19. Hack Tools
20. Tools 4 Hack
21. Hacking Tools Windows
22. Nsa Hacker Tools
23. Hack Tools For Games
24. Hacking Tools Mac
25. Pentest Tools Open Source
26. Hacker Search Tools
27. Pentest Tools Kali Linux
28. How To Install Pentest Tools In Ubuntu
29. Hacker Tools Mac
30. Hacker Tools Windows
31. Hacker Tool Kit
32. Pentest Tools Kali Linux
33. Usb Pentest Tools
34. Pentest Tools Nmap
35. Hack Tools For Pc
36. Hacking Tools For Windows 7
37. Beginner Hacker Tools
38. Pentest Automation Tools
39. Pentest Tools Tcp Port Scanner
40. Hacker Tools Software
41. Pentest Reporting Tools
42. Hacker Tools 2019
43. Hackers Toolbox
44. Hack Tools For Pc
45. Pentest Tools Port Scanner
46. Hack Tools For Mac
47. Termux Hacking Tools 2019
48. Hacking Tools For Windows
49. Pentest Reporting Tools
50. Hacker Tools For Pc
51. Hackrf Tools
52. Github Hacking Tools
53. Hacking App
54. Computer Hacker
55. Pentest Tools Download
56. Hacker Tools 2019
57. How To Install Pentest Tools In Ubuntu
58. Hack Tools For Pc
59. Hacking Tools Free Download
60. Hack Website Online Tool
61. Hacking Tools Software
62. Computer Hacker
63. Hacking Tools For Windows Free Download
64. Hack Tools Mac
65. Pentest Tools
66. Hacking Tools For Windows 7
67. Hacker Security Tools
68. Hacking Tools Github
69. Hackrf Tools
70. Hack Tools For Ubuntu
71. Hacking Tools 2019
72. Nsa Hack Tools Download
73. Kik Hack Tools
74. Hacking Tools For Mac
75. Hacking Tools 2019
76. Hacking Tools Free Download
77. Hacker Tools Apk Download
78. Hack Tools Mac
79. Hacker Tools For Ios
80. Hack Website Online Tool
81. Kik Hack Tools
82. Hackers Toolbox
83. Hacking Tools Software
84. Pentest Tools Website Vulnerability
85. Hacker Tools 2020
86. Pentest Tools Android
87. Game Hacking
88. Pentest Tools For Windows
89. Hacking Tools Software
90. Hack Website Online Tool
91. Pentest Tools Find Subdomains
92. Install Pentest Tools Ubuntu
93. How To Install Pentest Tools In Ubuntu
94. Pentest Tools Linux
95. Hacking Tools For Beginners
96. Hacker Tools Software
97. Pentest Tools Website
98. Kik Hack Tools
99. Pentest Tools Website Vulnerability
100. Beginner Hacker Tools
101. Hacker Tools Apk Download
102. Hacking Tools 2020
103. Hacker Tool Kit
104. Hacker Tools For Mac
105. Hack And Tools
106. Hacking Tools Usb
107. Blackhat Hacker Tools
108. Hak5 Tools
109. Underground Hacker Sites
110. Hacking Tools Mac
111. Computer Hacker
112. Pentest Tools Find Subdomains
113. Free Pentest Tools For Windows
114. Pentest Tools Tcp Port Scanner
115. Hacking Tools For Pc
116. Pentest Tools Download
117. Hacker Tools Software
118. Hack Tools Online
119. Best Hacking Tools 2020
120. Pentest Tools For Windows
121. Hacking Apps
122. Physical Pentest Tools
123. Hack Tools Online
124. Hacker Tool Kit
125. Hacker Tools Linux
126. Hacker Techniques Tools And Incident Handling
127. Hacker Tool Kit
128. Hack Tools For Windows
129. Hack Tools Online
130. How To Install Pentest Tools In Ubuntu
131. Black Hat Hacker Tools
132. Hacker Tools Mac
133. Pentest Tools Website
134. Hack Tools 2019
135. Pentest Tools Bluekeep
136. Hack Tools 2019
137. Hacker Tools Linux
138. Hacker Tools List
139. Pentest Tools Website Vulnerability
140. New Hack Tools
141. Free Pentest Tools For Windows
142. Pentest Tools Framework
143. Hacking Tools Mac
144. Hack Tool Apk No Root
145. Hack Tools For Pc
146. Hacking Tools For Windows
147. Hacker Tools Free
148. What Is Hacking Tools
149. Hacking Tools Free Download
150. Hak5 Tools
151. Hacker Tools Linux
152. Pentest Tools Windows
153. Growth Hacker Tools
154. Game Hacking
155. Pentest Tools For Mac
156. Hack Tools For Games
157. Computer Hacker
158. Hacking Tools Software
159. Best Hacking Tools 2020
160. Hacking Tools Github
161. Hacking Tools Kit
162. Hack Tools Pc
163. Pentest Tools Kali Linux
164. Hacking Tools For Windows
165. Wifi Hacker Tools For Windows
166. Bluetooth Hacking Tools Kali