This file is an 32bits elf binary, compiled from go language (i guess ... coded by @nibble_ds ;)
The binary has some debugging symbols, which is very helpful to locate the functions and api calls.
GO source functions:
- main.main
- main.function.001
If the binary is executed with no params, it prints "Nope!", the bad guy message.
~/ncn$ ./inbincible
Nope!
Decompiling the main.main function I saw two things:
1. The Argument validation: Only one 16 bytes long argument is needed, otherwise the execution is finished.
2. The key IF, the decision to dexor and print byte by byte the "Nope!" string OR dexor and print "Yeah!"
The incoming channel will determine the final message. |
Dexor and print each byte of the "Nope!" message. |
This IF, checks 16 times if the go channel reception value is 0x01, in this case the app show the "Yeah!" message.
Go channels are a kind of thread-safe queue, a channel_send is like a push, and channel_receive is like a pop.
If we fake this IF the 16 times, we got the "Yeah!" message:
(gdb) b *0x8049118
(gdb) commands
>set {char *}0xf7edeef3 = 0x01
>c
>end
(gdb) r 1234567890123456
tarting program: /home/sha0/ncn/inbincible 1234567890123456
...
Yeah!
Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.
This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.
=> 0x8049456: xor %ebp,%ecx
This xor, encode the argument with a key byte by byte |
The xor key can be dumped from memory but I prefer to use this macro:
(gdb) b *0x8049456
(gdb) commands
>i r ecx
>c
>end
(gdb) c
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x12 18
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x45 69
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x33 51
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x87 135
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x65 101
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x12 18
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x45 69
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x33 51
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x87 135
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x65 101
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x12 18
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x45 69
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x33 51
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x87 135
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x65 101
Breakpoint 2, 0x08049456 in main.func ()
ecx 0x12 18
The result of the xor will compared with another array byte, each byte matched, a 0x01 will be sent.
The cmp of the xored argument byte, will determine if the channel send 0 or 1 |
(gdb) b *0x0804946a
(gdb) commands
>i r al
>c
>end
At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.
Now web have:
xorKey=[0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12,0x45,0x33,0x87,0x65,0x12]
mustGive=[0x55,0x75,0x44,0xb6,0x0b,0x33,0x06,0x03,0xe9,0x02,0x60,0x71,0x47,0xb2,0x44,0x33]
Xor is reversible, then we can get the input needed to dexor to the expected values in order to send 0x1 bytes through the go channel.
>>> x=''
>>> for i in range(len(xorKey)):
... x+= chr(xorKey[i] ^ mustGive[i])
...
>>> print x
G0w1n!C0ngr4t5!!
And that's the key :) let's try it:
~/ncn$ ./inbincible 'G0w1n!C0ngr4t5!!'
Yeah!
Got it!! thanx @nibble_ds for this funny crackme, programmed in the great go language. I'm also a golang lover.
More info
- Hack Tools Download
- Pentest Tools Subdomain
- Pentest Tools For Android
- Pentest Tools Nmap
- Pentest Tools Download
- Hack Tools
- Easy Hack Tools
- What Is Hacking Tools
- Hacking Tools Github
- Hack Tool Apk No Root
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Windows Free Download
- Pentest Tools For Android
- Hacker Tools Free Download
- How To Hack
- Pentest Tools Find Subdomains
- Hacker Tool Kit
- Pentest Tools Download
- Hacker Tools List
- Hack And Tools
- Hacker Tools For Ios
- Easy Hack Tools
- Hacking Tools For Mac
- Easy Hack Tools
- How To Make Hacking Tools
- What Are Hacking Tools
- Tools Used For Hacking
- Hacking Tools 2020
- Pentest Box Tools Download
- Hacking Tools For Windows Free Download
- Wifi Hacker Tools For Windows
- Hack Tool Apk No Root
- What Are Hacking Tools
- Hacker Search Tools
- Hacking Tools Name
- Hacking Tools 2020
- Hacks And Tools
- Black Hat Hacker Tools
- Pentest Tools
- Pentest Tools Apk
- New Hacker Tools
- Hacking Apps
- What Are Hacking Tools
- How To Install Pentest Tools In Ubuntu
- Tools For Hacker
- Pentest Tools Nmap
- Pentest Recon Tools
- Pentest Tools Website Vulnerability
- Top Pentest Tools
- Hacking Tools Download
- Physical Pentest Tools
- Hacker Tools Linux
- Bluetooth Hacking Tools Kali
- Hacking Tools 2020
- Wifi Hacker Tools For Windows
- Pentest Tools
- How To Hack
- Pentest Tools Nmap
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Online
- Hacking Tools For Windows 7
- Hack Tool Apk
- Android Hack Tools Github
- Hacker Tools For Mac
- Hacking Tools Software
- Hacker Security Tools
- Hack Tools Download
- Hack And Tools
- Hackers Toolbox
- Ethical Hacker Tools
- What Are Hacking Tools
- Hacking Tools Windows 10
- Hack Tools For Games
- Hacking Tools Online
- Hack And Tools
- Hack Tools Pc
- Hacker Tools Software
- Pentest Tools Linux
- Hack Tools For Games
- Hacker Tools Hardware
- Hacking Tools For Windows 7
- Pentest Reporting Tools
- Hacker Tool Kit
- Pentest Tools Free
- New Hacker Tools
- Hacking Tools Hardware
- Hacking Tools For Kali Linux
- Hack Rom Tools
- Pentest Tools For Mac
- Hacker Tools 2020
- Pentest Tools Download
- Pentest Tools Review
- Install Pentest Tools Ubuntu
- Hacker Tools Apk
- Hacking Tools For Games
- Game Hacking
- Ethical Hacker Tools
- Hacker Tools Windows
- Hacking Tools
- Hack Tools Download
- Hack Rom Tools
- Android Hack Tools Github
- Hack Tools For Ubuntu
- Hacker Tools Apk Download
- Hack Tools For Pc
- Pentest Tools Port Scanner
- Pentest Tools For Android
- Tools For Hacker
- Hack Tools For Mac
- Hacker
- Hacking Tools Hardware
- Pentest Automation Tools
No comments:
Post a Comment