Hide archived files in images files

hide-me.md

Intro

This is quick trick to hide archived files in image files i.e. files with the extension *.png, *.gif, *.jpeg, etc.

Step 1

Find an image file you want to use.

For example, I decied to use this gif:

To download that ⬆️ gif:

wget https://media.giphy.com/media/1Fwe7WUbKcE0BStVHe/giphy.gif

Output:

--2019-03-30 20:13:32--  https://media.giphy.com/media/1Fwe7WUbKcE0BStVHe/giphy.gif
Resolving media.giphy.com (media.giphy.com)... 151.101.42.2
Connecting to media.giphy.com (media.giphy.com)|151.101.42.2|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 23958455 (23M) [image/gif]
Saving to: ‘giphy.gif’

giphy.gif               100%[=============================>]  22.85M  8.61MB/s    in 2.7s

2019-03-30 20:13:35 (8.61 MB/s) - ‘giphy.gif’ saved [23958455/23958455]

Step 2

Create a file or file(s) that you want to hide.

To put a "secret" message in a text file: 👀

echo "Hey, meet me at 36.141736, 137.252881. Bring the goods and be on time, 21:39:45 UTC/GMT+9" > for_your_eyes_only.txt

Step 3

There are a number of ways to archive file(s), e.g. utilities such as tar and gzip or zip.

This StackExchange discussion shows a number of ways to achieve this.

Run the following to create secret.zip:

zip secret.zip for_your_eyes_only.txt

Step 4

The actual hiding. Concatenate the archived file into the gif:

cat secret.zip > giphy.gif 

To uncover the archive from the image file

To extract file(s) simply run:

unzip giphy.gif

Output:

Archive:  giphy.gif
  inflating: for_your_eyes_only.txt

To see if anything can be extracted from an image file:

unzip -t giphy.gif

Output:

Archive:  giphy.gif
    testing: for_your_eyes_only.txt   OK
No errors detected in compressed data of giphy.gif.

This doesn't extract for_your_eyes_only.txt.

The -t flag:
test archive files. This option extracts each specified file in memory and compares the CRC (cyclic redundancy check, an enhanced checksum) of the expanded file with the original file's stored CRC value.

Where to go from here?

1. Hacker Lexicon: What Is Steganography?
2. Steganography Implementation via LSB method
3. zsteg gem: https://github.com/zed-0xff/zsteg
4. LSBSteg.py | Usage Tutorial
5. steghide on Kali Linux