Sunday, August 30, 2020

inBINcible Writeup - Golang Binary Reversing

This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)
The binary has some debugging symbols, which is very helpful to locate the functions and api calls.

GO source functions:
-  main.main
-  main.function.001

If the binary is executed with no params, it prints "Nope!", the bad guy message.

~/ncn$ ./inbincible 
Nope!

Decompiling the main.main function I saw two things:

1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.

2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"


The incoming channel will determine the final message.


Dexor and print each byte of the "Nope!" message.


This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.

Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.

If we fake this IF the 16 times, we got the "Yeah!" message:

(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end

(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!


Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.
This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.

=> 0x8049456:       xor    %ebp,%ecx
This xor,  encode the argument with a key byte by byte

The xor key can be dumped from memory but I prefer to use this macro:

(gdb) b *0x8049456
(gdb) commands
>i r  ecx
>c
>end
(gdb) c

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x45 69

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x33 51

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x87 135

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x65 101

Breakpoint 2, 0x08049456 in main.func ()
ecx            0x12 18

The result of the xor will compared with another array byte,  each byte matched, a 0x01 will be sent.

The cmp of the xored argument byte,
will determine if the channel send 0 or 1


(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end

At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.


Now web have:

xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]

mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]


Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.

>>> x=''
>>> for i in range(len(xorKey)):
...     x+= chr(xorKey[i] ^ mustGive[i])
... 
>>> print x

G0w1n!C0ngr4t5!!


And that's the key :) let's try it:

~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!

Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.


More info
  1. Tools 4 Hack
  2. Nsa Hacker Tools
  3. Hacker Tools 2020
  4. Pentest Tools For Windows
  5. New Hacker Tools
  6. Hacker Tools Linux
  7. Hacker Tools Linux
  8. Hacking Tools For Windows Free Download
  9. Hacker Tools List
  10. Hacking Tools For Pc
  11. Hacking Tools Online
  12. Hacking Tools 2020
  13. Hacker Tools Software
  14. Hacking Tools For Games
  15. Pentest Tools Alternative
  16. Hacking Tools For Kali Linux
  17. Pentest Tools Alternative
  18. Blackhat Hacker Tools
  19. Hacker Tools For Mac
  20. Pentest Tools Subdomain
  21. Pentest Tools Android
  22. Pentest Tools Nmap
  23. Hacker Tools Linux
  24. Nsa Hack Tools Download
  25. Hack Rom Tools
  26. Hacker Tools Free Download
  27. Black Hat Hacker Tools
  28. Pentest Tools Port Scanner
  29. Hack And Tools
  30. Hack Tools 2019
  31. Pentest Tools Port Scanner
  32. Black Hat Hacker Tools
  33. Nsa Hacker Tools
  34. Pentest Tools Website
  35. Pentest Tools Windows
  36. Best Pentesting Tools 2018
  37. Growth Hacker Tools
  38. Hacker Tools Windows
  39. Hacking Tools For Games
  40. Hacking Tools Pc
  41. Hacker Tools Apk Download
  42. Underground Hacker Sites
  43. Hacker Tools For Mac
  44. Hack Tools For Pc
  45. Pentest Tools Subdomain
  46. Tools Used For Hacking
  47. Nsa Hack Tools Download
  48. Hacker Tools Free Download
  49. Pentest Tools Port Scanner
  50. Android Hack Tools Github
  51. Easy Hack Tools
  52. What Are Hacking Tools
  53. Hacking Tools Mac
  54. Kik Hack Tools
  55. Hacking Tools Windows
  56. Pentest Tools Bluekeep
  57. Pentest Tools Website Vulnerability
  58. Hacker Tools Linux
  59. Tools Used For Hacking
  60. Pentest Tools Github
  61. Hacker Techniques Tools And Incident Handling
  62. Best Hacking Tools 2019
  63. Easy Hack Tools
  64. Top Pentest Tools
  65. Hacking Tools Software
  66. Kik Hack Tools
  67. Hacker Tools For Mac
  68. Hacking Tools For Pc
  69. Hacking Tools Windows
  70. Hacker Search Tools
  71. Hacker Search Tools
  72. What Are Hacking Tools
  73. Hacking Tools Github
  74. Hacking Tools For Mac
  75. Pentest Tools For Windows
  76. Hacking Tools Windows 10
  77. Hacker
  78. Hack Tools Online
  79. Pentest Tools Framework
  80. Pentest Tools Subdomain
  81. Github Hacking Tools
  82. Pentest Tools For Android
  83. Pentest Tools For Android
  84. Pentest Tools Download
  85. Pentest Tools Linux
  86. Pentest Tools Kali Linux
  87. Hacking Apps
  88. Hacking Tools Pc
  89. Pentest Tools Subdomain
  90. New Hack Tools
  91. Hacker Tools Free
  92. Hacker Tools
  93. Underground Hacker Sites
  94. Pentest Tools Github
  95. Hack Tools Online
  96. Pentest Tools Alternative
  97. Pentest Tools Bluekeep
  98. New Hacker Tools
  99. Pentest Tools Find Subdomains
  100. Hacker Tools Apk Download
  101. Hacking Tools Online
  102. Hacker
  103. Pentest Automation Tools
  104. Hacker Tools Mac
  105. Hack Tools
  106. Nsa Hack Tools Download
  107. New Hack Tools
  108. Pentest Automation Tools
  109. Hack Tools Mac
  110. Termux Hacking Tools 2019
  111. Hacking Tools Mac
  112. Hacking Tools Mac
  113. Hack Tools Download
  114. Hack Tools Online
  115. Hacking Tools Online
  116. Free Pentest Tools For Windows
  117. Hacker Tools
  118. Pentest Automation Tools
  119. Pentest Tools Find Subdomains
  120. Hacking Tools For Windows 7
  121. Hacking Tools For Kali Linux
  122. Pentest Tools Website Vulnerability
  123. Top Pentest Tools
  124. Hack Tools For Ubuntu
  125. Usb Pentest Tools
  126. Pentest Tools Tcp Port Scanner
  127. Hacker Tools Software
  128. Hacking Tools For Games
  129. Growth Hacker Tools
  130. Hack Tools
  131. Hack Tools For Mac
  132. Pentest Tools Bluekeep
  133. Usb Pentest Tools
  134. Hacking Tools For Windows
  135. Github Hacking Tools
  136. Computer Hacker
  137. Hacker Tools List
  138. Hacking Tools Windows 10
  139. How To Install Pentest Tools In Ubuntu
  140. Hack Tools For Pc
  141. Hak5 Tools
  142. Hacking Tools Github
  143. Hacking Tools Windows 10
  144. Nsa Hacker Tools
  145. Hacking Tools For Windows Free Download
  146. Hack Tools For Windows
  147. Pentest Tools Bluekeep
  148. Hack Apps
  149. Pentest Tools Kali Linux
  150. Pentest Automation Tools
  151. Hack Tools For Mac
  152. Pentest Recon Tools
  153. Bluetooth Hacking Tools Kali
  154. How To Make Hacking Tools
  155. Hacker Tools For Pc
  156. Pentest Tools Nmap
  157. Hack Rom Tools
  158. Hacker Tools Mac

No comments:

Post a Comment