ghaymah-v2-audits/Live_Binary_Reverse_Engineering_Report.md

🚨 Ghaymah CLI v2 - Live Binary Security Vulnerability Report

Target Asset: gy-linux-amd64 (Live Production Binary) Source: https://cliv2.ghaymah.systems/install.sh Vulnerability Type: Sensitive Information Disclosure & Architecture Leakage (CWE-200) Severity: HIGH 🔴

---

📑 Executive Summary

During a routine security audit of the Live Production Binary downloaded directly from the deployment server, a critical misconfiguration in the build pipeline was discovered.

While the developers successfully stripped the binary (-ldflags="-s -w"), they failed to apply UPX packing. As a result, the binary leaves the PCLNTAB (Program Counter Line Table) and hardcoded data segments completely exposed to static analysis. This allows any attacker to extract the internal backend architecture, API endpoints, and execution flow without executing the binary.

---

🕵️‍♂️ Reverse Engineering Proof of Concept (PoC)

The following data was successfully extracted from the live gy-linux-amd64 binary using basic string extraction and static analysis techniques. No advanced decompilation tools were required.

Caution

The exposure of internal S3 buckets and backend GraphQL endpoints provides attackers with direct vectors to bypass the CLI and attack the infrastructure directly.

======================================================================
[ TARGET ]: gy-linux-amd64 (12.2 MB - Unpacked)
[ METHOD ]: Static String Analysis & PCLNTAB Extraction
======================================================================

[+] EXTRACTED BACKEND INFRASTRUCTURE (ENDPOINTS)
----------------------------------------------------------------------
auth.ghaymah.systems
genai.ghaymah.systems
graphql.ghaymah.systems
logs.ghaymah.systems
s3-nhost-proxy-83e02743fd61.hosted.ghaymah.systems

[+] EXTRACTED INTERNAL FUNCTION SIGNATURES (EXECUTION FLOW)
----------------------------------------------------------------------
main.main
main.func1
main.pySecret
main.pygem
main.tsdeno
main.tsBinNamemain
main.String

[+] EXTRACTED SENSITIVE KEYWORDS
----------------------------------------------------------------------
secret
TOKEN
API_KEY
password

---

💥 Impact Analysis

1. Infrastructure Exposure: Attackers can map out the microservices architecture (auth, graphql, logs, genai).
2. Direct Targeting: The s3-nhost-proxy URL is highly sensitive. Attackers can bypass the CLI's security scanners and attempt to upload malicious payloads directly to the storage bucket.
3. Scanner Logic Leakage: Exposed function names like main.pySecret and main.tsdeno reveal how the pre-deployment scanner detects secrets and identifies project types, allowing attackers to design payloads that specifically evade these checks.

---

🛠️ Remediation & Patch Instructions

Important

The current live binary must be replaced immediately. The CI/CD pipeline or Makefile must be updated to include the UPX packing step.

Fix: Apply UPX compression with LZMA to the stripped binary before publishing it to the server. This will compress the data segments and scramble the plain-text strings in memory.

# 1. Build and strip
go build -ldflags="-s -w -trimpath" -o gy-linux-amd64

# 2. Pack with UPX (MISSING STEP)
upx --best --lzma gy-linux-amd64