bannsec / stegoveritas Goto Github PK

View Code? Open in Web Editor NEW

335.0 12.0 39.0 2.32 MB

Yet another Stego Tool

License: GNU General Public License v2.0

Python 99.67% Parrot 0.33%

stego steganography python3

stegoveritas's Introduction

StegoVeritas

Yet another Stego Tool

Quick Start

Install

Option 1 -- pip

$ pip3 install stegoveritas
$ stegoveritas_install_deps

stegoveritas_install_deps currently supports: ubuntu, debian, kali, parrotOS, fedora, archlinux and MacOS.

Option 2 -- docker

$ sudo docker run -it --rm bannsec/stegoveritas

Option 3 -- BlackArch

$ sudo pacman -S stegoveritas

PKGBUILD

Running

StegoVeritas has default actions for most image types (gif,jpeg,png,tiff,bmp) and will attempt to run on any file.

stegoveritas <file>

If you want to do something specific, you can check out the help:

stegoveritas -h
usage: stegoveritas [-h] [-out dir] [-debug] [-password PASSWORD]
                    [-wordlist WORDLIST] [-meta] [-imageTransform]
                    [-bruteLSB] [-colorMap [N [N ...]]]
                    [-colorMapRange Start End] [-extractLSB]
                    [-red index [index ...]] [-green index [index ...]]
                    [-blue index [index ...]] [-alpha index [index ...]]
                    [-extract_frames] [-trailing] [-steghide] [-exif]
                    [-xmp] [-carve] [-steghide]
                    file

Yet another Stego tool

positional arguments:
  file                  The file to analyze

optional arguments:
  -h, --help            show this help message and exit
  -out dir              Directory to place output in. Defaults to ./results
  -debug                Enable debugging logging.
  -password PASSWORD    When applicable, attempt to use this password to
                        extract data.
  -wordlist WORDLIST    When applicable, attempt to brute force with this
                        wordlist.

image options:
  -meta                 Check file for metadata information
  -imageTransform       Perform various image transformations on the input
                        image and save them to the output directory
  -bruteLSB             Attempt to brute force any LSB related steganography.
  -colorMap [N [N ...]]
                        Analyze a color map. Optional arguments are colormap
                        indexes to save while searching
  -colorMapRange Start End
                        Analyze a color map. Same as colorMap but implies a
                        range of colorMap values to keep
  -extractLSB           Extract a specific LSB RGB from the image. Use with
                        -red, -green, -blue, and -alpha
  -red index [index ...]
  -green index [index ...]
  -blue index [index ...]
  -alpha index [index ...]
  -extract_frames       Split up an animated gif into individual frames.
  -trailing             Check for trailing data on the given file
  -steghide             Check for StegHide hidden info.

multi options:
  -exif                 Check this file for exif information.
  -xmp                  Check this file for XMP information.
  -carve                Attempt to carve/extract things from this file.

Have a good example? Wish it did something more? Submit a ticket:
https://github.com/bannsec/stegoVeritas

stegoveritas's People

Contributors

Stargazers

Watchers

stegoveritas's Issues

_dumpLSBRGBA

Mode:	RGB

Trying 0.0.0
Traceback (most recent call last):
  File "stegoveritas.py", line 71, in <module>
    modules.image.run(fArray,args)
  File "~/Documents/stegoVeritas-master/modules/image/__init__.py", line 106, in run
    modules.image.imageLSB.auto(f,args)
  File "~/Documents/stegoVeritas-master/modules/image/imageLSB.py", line 142, in auto
    o = _dumpLSBRGBA(f=f,rIndex=[i],gIndex=[i],bIndex=[i])
  File "~/Documents/stegoVeritas-master/modules/image/imageLSB.py", line 93, in _dumpLSBRGBA
    binStr += str(fBytes[byte + 0] >> index & 1)
TypeError: unsupported operand type(s) for >>: 'str' and 'int'

Incorporate OpenStego

Because why not. Just give it a shot automagically.

Python 3.9 compatibility error

ERROR:stegoveritas.helpers:module 'magic' has no attribute 'from_buffer'
ERROR:stegoveritas.helpers:
"""
Traceback (most recent call last):
  File "/usr/lib/python3.9/multiprocessing/pool.py", line 125, in worker
    result = (True, func(*args, **kwds))
  File "/usr/lib/python3.9/site-packages/stegoveritas/modules/image/analysis/brute_lsb.py", line 13, in run_dump
    image.veritas.test_output(o)
  File "/usr/lib/python3.9/site-packages/stegoveritas/stegoveritas.py", line 79, in test_output
    m = magic.from_buffer(thing, mime=True)
AttributeError: module 'magic' has no attribute 'from_buffer'
"""

platform.dist() deprecation

About install_deps.py

>>> platform.dist()
__main__:1: DeprecationWarning: dist() and linux_distribution() functions are deprecated in Python 3.5

Similar issue and fix: saltstack/salt#37070

According to https://bugs.python.org/issue1322, it will be removed in python 3.8.

get this error when I run stegoveritas /home/user/Desktop/DSWii6x.png

ERROR:stegoveritas.helpers:unrecognized data stream contents when reading image file
^[[AERROR:stegoveritas.helpers:list index out of range
ERROR:stegoveritas.helpers:
"""
Traceback (most recent call last):
File "/usr/lib/python3.8/multiprocessing/pool.py", line 125, in worker
result = (True, func(*args, **kwds))
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/modules/image/analysis/brute_lsb.py", line 13, in run_dump
image.veritas.test_output(o)
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 119, in test_output
table.add_row([hex(result.offset), 'Extracted', result.description, os.path.basename(module.extractor.output[result.file.path].extracted[result.offset].files[0])])
IndexError: list index out of range
"""
ERROR:stegoveritas.helpers:list index out of range
ERROR:stegoveritas.helpers:
"""
Traceback (most recent call last):
File "/usr/lib/python3.8/multiprocessing/pool.py", line 125, in worker
result = (True, func(*args, **kwds))
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/modules/image/analysis/brute_lsb.py", line 13, in run_dump
image.veritas.test_output(o)
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 119, in test_output
table.add_row([hex(result.offset), 'Extracted', result.description, os.path.basename(module.extractor.output[result.file.path].extracted[result.offset].files[0])])
IndexError: list index out of range
"""
ERROR:stegoveritas.helpers:[Errno 2] No such file or directory
ERROR:stegoveritas.helpers:
"""
Traceback (most recent call last):
File "/usr/lib/python3.8/multiprocessing/pool.py", line 125, in worker
result = (True, func(*args, **kwds))
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/modules/image/analysis/brute_lsb.py", line 13, in run_dump
image.veritas.test_output(o)
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 99, in test_output
saved_dir = os.getcwd()
FileNotFoundError: [Errno 2] No such file or directory
"""
ERROR:stegoveritas.helpers:[Errno 2] No such file or directory
ERROR:stegoveritas.helpers:
"""
Traceback (most recent call last):
File "/usr/lib/python3.8/multiprocessing/pool.py", line 125, in worker
result = (True, func(*args, **kwds))
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/modules/image/analysis/brute_lsb.py", line 13, in run_dump
image.veritas.test_output(o)
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 99, in test_output
saved_dir = os.getcwd()
FileNotFoundError: [Errno 2] No such file or directory

Add py3exiv2

Having some reliability issues with exifread. Look at implementing py3exiv2:

https://python3-exiv2.readthedocs.io/en/latest/tutorial.html

Conflicting License Info

Repo's LICENSE.md file is GPLv2, but setup.py says the license is MIT.

Is this a mistake, or is there a reason for this?

Getting syntax error

I updated my Kali and Stegoveritas stopped working, I tried running it with python2/3 - Any suggestions?

Traceback (most recent call last): File "/usr/local/bin/stegoveritas", line 5, in <module> from stegoveritas.stegoveritas import main File "/usr/local/lib/python2.7/dist-packages/stegoveritas/__init__.py", line 2, in <module> from .stegoveritas import StegoVeritas File "/usr/local/lib/python2.7/dist-packages/stegoveritas/stegoveritas.py", line 213 def file_name(self) -> str: ^ SyntaxError: invalid syntax

png colortype rgb with alpha not supported by PIL

getting this when trying to run stegoveritas on a png with transparency, my guess is the version of PIL doesn't support it, but this might not actually be integral to the operation of stegoveritas. figured it was worth an issue though

ERROR:stegoveritas.helpers:not supported for this image mode
ERROR:stegoveritas.helpers:
"""
Traceback (most recent call last):
  File "/usr/lib/python3.10/multiprocessing/pool.py", line 125, in worker
    result = (True, func(*args, **kwds))
  File "/home/brubsby/.local/lib/python3.10/site-packages/stegoveritas/modules/image/analysis/filters.py", line 33, in run_image_op
    img = op(image.file)
  File "/home/brubsby/.local/lib/python3.10/site-packages/PIL/ImageOps.py", line 155, in autocontrast
    return _lut(image, lut)
  File "/home/brubsby/.local/lib/python3.10/site-packages/PIL/ImageOps.py", line 60, in _lut
    raise OSError(msg)
OSError: not supported for this image mode
"""

running stegoveritas on wsl2 on win11

relative path error

relative path doesn't work:

$ ~/CTF/tools/stegoVeritas/stegoveritas.py steg1/secret.jpg 
Type:   JPEG (ISO 10918)
Mode:   RGB

Checking Meta Data

Exif Data
=========
Image XResolution:      1
Image YResolution:      1
Image ResolutionUnit:   Not Absolute
Image Artist:   d0ntTr!
Image YCbCrPositioning: Centered


Checking for trailing data
Trailing Data Discovered... Saving
b'd0ntTr!'
Running image filters
Traceback (most recent call last):
  File "/home/noraj/CTF/tools/stegoVeritas/stegoveritas.py", line 70, in <module>
    modules.image.run(fArray,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/__init__.py", line 98, in run
    autoAnalysis(f,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/__init__.py", line 29, in autoAnalysis
    modules.image.imageFilters.auto(f,args.outDir)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/imageFilters.py", line 87, in auto
    g.save(os.path.join(outDir,fileName + "_" + filt.name.replace(" ","_") + ".png"))
  File "/usr/lib/python3.7/site-packages/PIL/Image.py", line 2004, in save
    fp = builtins.open(filename, "w+b")
FileNotFoundError: [Errno 2] No such file or directory: '/home/noraj/CTF/XXX/files/results/steg1/secret.jpg_Edge-enhance.png'

file in current folder works:

$ ~/CTF/tools/stegoVeritas/stegoveritas.py secret.jpg      
Type:   JPEG (ISO 10918)
Mode:   RGB

Checking Meta Data

Exif Data
=========
Image XResolution:      1
Image YResolution:      1
Image ResolutionUnit:   Not Absolute
Image Artist:   d0ntTr!
Image YCbCrPositioning: Centered


Checking for trailing data
Trailing Data Discovered... Saving
b'd0ntTr!'
Running image filters
Attempting to brute force LSB items
Trying 0.0.0
Trying 1.1.1
Trying 2.2.2

absolute path works:

$ ~/CTF/tools/stegoVeritas/stegoveritas.py /home/noraj/CTF/XXX/files/steg1/secret.jpg
Type:   JPEG (ISO 10918)
Mode:   RGB

Checking Meta Data

Exif Data
=========
Image XResolution:      1
Image YResolution:      1
Image ResolutionUnit:   Not Absolute
Image Artist:   d0ntTr!
Image YCbCrPositioning: Centered


Checking for trailing data
Trailing Data Discovered... Saving
b'd0ntTr!'
Running image filters
Attempting to brute force LSB items
Trying 0.0.0
Trying 1.1.1

New issue when trying to use stegoVeritas

+---------+------------------+---------------------------------------------------------------------------------------------------------------------+---------------+
| 0x1d4f6 | Carved | gzip compressed data, maximum compression, has original file name: "layer2.png", last modified: 2020-06-27 13:44:15 | layer2.png.gz |
| 0x1d4f6 | Extracted | gzip compressed data, maximum compression, has original file name: "layer2.png", last modified: 2020-06-27 13:44:15 | layer2.png |
| 0x1d539 | Carved | Zlib compressed data, default compression | 1D539.zlib |
| 0x1d539 | Extracted | Zlib compressed data, default compression | 1D539 |
+---------+------------------+---------------------------------------------------------------------------------------------------------------------+---------------+
Traceback (most recent call last):
File "/usr/lib/python3.8/shutil.py", line 788, in move
os.rename(src, real_dst)
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/tmps1sboa4g/_scanme.extracted/layer2.png.gz' -> '/home/user/results/keepers/layer2.png.gz'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/bin/stegoveritas", line 10, in
sys.exit(main())
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 257, in main
veritas.run()
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 53, in run
module.run()
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/modules/init.py", line 31, in run
module.run(self)
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/modules/multi/analysis/carve.py", line 29, in run
multi.veritas.test_output(f.read())
File "/usr/local/lib/python3.8/dist-packages/stegoveritas/stegoveritas.py", line 134, in test_output
shutil.move( keeper, keeper_dst )
File "/usr/lib/python3.8/shutil.py", line 802, in move
copy_function(src, real_dst)
File "/usr/lib/python3.8/shutil.py", line 432, in copy2
copyfile(src, dst, follow_symlinks=follow_symlinks)
File "/usr/lib/python3.8/shutil.py", line 261, in copyfile
with open(src, 'rb') as fsrc, open(dst, 'wb') as fdst:
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/tmps1sboa4g/_scanme.extracted/layer2.png.gz'

trying to extract every bit of data from the file attached

ModuleNotFoundError: No module named 'magic'

After correcting 2 instances of /usr/bin/env python to /usr/bin/env python3 i still get this error below.
OS: Kali 2018.3 rolling

./stegoveritas.py art.png

Type: Portable network graphics
Mode: RGBA

Traceback (most recent call last):
File "./stegoveritas.py", line 69, in
import modules.image
File "/opt/stegoVeritas/modules/image/init.py", line 1, in
import modules.image.imageLSB
File "/opt/stegoVeritas/modules/image/imageLSB.py", line 6, in
import magic
ModuleNotFoundError: No module named 'magic'

Change file to python magic module

Need to remove the dependency on the unix file command and use some platform independent python module for that.

Ref #1

imageLSB.py error

Since I don't know when a error occured preventing stegoveritas from doing LSB checks:

Traceback (most recent call last):
  File "/home/noraj/CTF/tools/stegoVeritas/stegoveritas.py", line 70, in <module>
    modules.image.run(fArray,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/__init__.py", line 98, in run
    autoAnalysis(f,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/__init__.py", line 37, in autoAnalysis
    modules.image.imageLSB.auto(f,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/imageLSB.py", line 143, in auto
    testOutput(o,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/imageLSB.py", line 23, in testOutput
    m = magic.from_buffer(b,mime=True)
AttributeError: module 'magic' has no attribute 'from_buffer'

I checked I still have teh dependencies. I don't think it's something that change in the script but something on the system.

PS : I'm up to date with the git.

I think I found there is 3 libs named exactly python-magic, see this

python-magic 5.29-2
python2-magic 5.29-2

Propagate default run down to veritas class

Will need to propagate the default run value down to the base Veritas class.

AttributeError: module 'magic' has no attribute 'from_buffer'

Analyzing a jped image I got

Type:   JPEG (ISO 10918)
Mode:   RGB

Checking Meta Data

Exif Data
=========


Checking for trailing data
Running image filters
Attempting to brute force LSB items
Trying 0.0.0
Traceback (most recent call last):
  File "/home/noraj/CTF/tools/stegoVeritas/stegoveritas.py", line 70, in <module>
    modules.image.run(fArray,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/__init__.py", line 98, in run
    autoAnalysis(f,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/__init__.py", line 37, in autoAnalysis
    modules.image.imageLSB.auto(f,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/imageLSB.py", line 143, in auto
    testOutput(o,args)
  File "/home/noraj/CTF/tools/stegoVeritas/modules/image/imageLSB.py", line 23, in testOutput
    m = magic.from_buffer(b,mime=True)
AttributeError: module 'magic' has no attribute 'from_buffer'

All dependencies installed, sorry I cant share the pic.

cant run stegoveritas in terminal (Kali)

Running Kali on a VM, Installed stegoveritas through pip, and then wanted to install the dependencies and it shows command not found.

Any ideas?

Unable to run/install modules.image

When attempting to run stegoVeritas.py I am consistently receiving this error. Is this normal? I've installed all dependencies.

Type:	Windows Bitmap
Mode:	RGB

Traceback (most recent call last):
  File "stegoveritas.py", line 69, in <module>
    import modules.image
ImportError: No module named 'modules.image'; 'modules' is not a package

in the ~/stegoVeritas/modules folder should an __init.py__ be placed?

stegoveritas-binwalk

What is the difference between stegoveritas-binwalk and binwalk.
If they are the same, why a new python package?
IF they are different, why there is not a git repository of the patch applied to transform binwalk into stegoveritas-binwalk?

user@Com - 901 Downloads %  stegoveritas_install_deps 
Traceback (most recent call last):
  File "/Users/user/anaconda3/bin/stegoveritas_install_deps", line 5, in <module>
    from stegoveritas.install_deps import main
  File "/Users/user/anaconda3/lib/python3.8/site-packages/stegoveritas/__init__.py", line 2, in <module>
    from .stegoveritas import StegoVeritas
  File "/Users/user/anaconda3/lib/python3.8/site-packages/stegoveritas/stegoveritas.py", line 15, in <module>
    import magic
  File "/Users/user/anaconda3/lib/python3.8/site-packages/magic.py", line 201, in <module>
    raise ImportError('failed to find libmagic.  Check your installation')
ImportError: failed to find libmagic.  Check your installation