{"id":769,"date":"2014-03-26T02:54:11","date_gmt":"2014-03-26T02:54:11","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=769"},"modified":"2014-03-26T02:54:38","modified_gmt":"2014-03-26T02:54:38","slug":"stego_in_c_sharp","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2014\/03\/stego_in_c_sharp\/","title":{"rendered":"Steganography Application in C#"},"content":{"rendered":"<p>Howdy all!<\/p>\n<p>Today I have, instead of malware and hax, something a little different.<br \/>\n<a href=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/xv1.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/xv1-300x212.png\" alt=\"xv1\" width=\"300\" height=\"212\" class=\"alignnone size-medium wp-image-770\" srcset=\"https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/xv1-300x212.png 300w, https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/xv1.png 703w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The app makes use of simple stream ciphers to embed any other file I want into any picture I want WITHOUT breaking the original pic.<\/p>\n<p>Recall from one of <a href=\"http:\/\/www.gironsec.com\/blog\/2013\/10\/stego-malware-and-dotnet\/\">my other posts<\/a> that they(malware writers) did utilize a form of steganography, but either didn&#8217;t embed another pic or didn&#8217;t care to. <\/p>\n<p>The application makes use of a key file in the following format:<br \/>\n-=-enctype-=&#8211;=-newline-=&#8211;=-lengthoforiginaljpg-=&#8211;=-newline-=&#8211;=-lengthofencodedexe-=&#8211;=-newline-=&#8211;=-keyvalue-=&#8211;=-GironSec-=-<br \/>\nLike all key files, they need to be kept in a safe place. <\/p>\n<p>Since I&#8217;m not exactly using powerful encryption here(RC4 \/ bitwise operations), there is a weakness &#8211; the encrypted content can be brute forced as the key is of variable length. The idea here however isn&#8217;t powerful encryption, but to instead hide in plain sight. A small program tacked onto a large JPG will be invisible to both the reverser and the naked eye. <\/p>\n<p>Download the app \/ source <a href=\"http:\/\/gironsec.com\/code\/Stego_App.7z\">here<\/a>.<\/p>\n<p>Happy Hacking!<\/p>\n<p><a href=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/1384567263190.jpg\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/1384567263190.jpg\" alt=\"1384567263190\" width=\"499\" height=\"660\" class=\"alignnone size-full wp-image-773\" srcset=\"https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/1384567263190.jpg 499w, https:\/\/www.gironsec.com\/blog\/wp-content\/uploads\/2014\/03\/1384567263190-226x300.jpg 226w\" sizes=\"(max-width: 499px) 100vw, 499px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Howdy all! Today I have, instead of malware and hax, something a little different. The app makes use of simple stream ciphers to embed any other file I want into any picture I want WITHOUT breaking the original pic. Recall from one of my other posts that they(malware writers) did utilize a form of steganography, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/769"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=769"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/769\/revisions"}],"predecessor-version":[{"id":775,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/769\/revisions\/775"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=769"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=769"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}