summaryrefslogtreecommitdiff
path: root/stegtoy
diff options
context:
space:
mode:
authorJakob L. Kreuze <zerodaysfordays@sdf.org>2021-04-06 12:23:00 -0400
committerJakob L. Kreuze <zerodaysfordays@sdf.org>2021-04-06 12:25:17 -0400
commit983cd29f5a2c3d9cd1d6a9c4f343adcffe54f88c (patch)
tree395f4bf2dfe097d9d09413ad1b805765b2e7eae0 /stegtoy
Initial import.HEADmaster
Diffstat (limited to 'stegtoy')
-rw-r--r--stegtoy/Dockerfile15
-rw-r--r--stegtoy/Makefile7
-rw-r--r--stegtoy/app/requirements.txt10
-rw-r--r--stegtoy/app/stegtoy.py45
-rw-r--r--stegtoy/bmpencode.c98
5 files changed, 175 insertions, 0 deletions
diff --git a/stegtoy/Dockerfile b/stegtoy/Dockerfile
new file mode 100644
index 0000000..8ddf77f
--- /dev/null
+++ b/stegtoy/Dockerfile
@@ -0,0 +1,15 @@
+FROM ubuntu:20.10
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get install -y \
+ python3-dev python3-pip python3-setuptools
+
+ENV APP_HOME /app
+RUN mkdir ${APP_HOME}
+WORKDIR ${APP_HOME}
+
+COPY ./app ${APP_HOME}
+RUN pip3 install --no-cache-dir -r requirements.txt
+CMD ["gunicorn", "-w", "4", "-b", "0.0.0.0:8086", "stegtoy:app"]
+EXPOSE 8086
diff --git a/stegtoy/Makefile b/stegtoy/Makefile
new file mode 100644
index 0000000..12ba1a3
--- /dev/null
+++ b/stegtoy/Makefile
@@ -0,0 +1,7 @@
+all: bmpencode
+
+bmpencode.o: bmpencode.c
+ gcc -g -c -o bmpencode.o bmpencode.c
+
+bmpencode: bmpencode.o
+ gcc -g -o bmpencode bmpencode.o
diff --git a/stegtoy/app/requirements.txt b/stegtoy/app/requirements.txt
new file mode 100644
index 0000000..d9b53c5
--- /dev/null
+++ b/stegtoy/app/requirements.txt
@@ -0,0 +1,10 @@
+click==7.1.2
+Flask==1.1.2
+Flask-JWT-Extended==4.1.0
+gunicorn==20.0.4
+itsdangerous==1.1.0
+Jinja2==2.11.3
+MarkupSafe==1.1.1
+PyJWT==2.0.1
+Werkzeug==1.0.1
+requests==2.25.1
diff --git a/stegtoy/app/stegtoy.py b/stegtoy/app/stegtoy.py
new file mode 100644
index 0000000..2c9c4b9
--- /dev/null
+++ b/stegtoy/app/stegtoy.py
@@ -0,0 +1,45 @@
+import os
+import subprocess
+import shlex
+from flask import Flask, flash, request, redirect, make_response, url_for
+from werkzeug.utils import secure_filename
+
+app = Flask(__name__)
+
+@app.route('/', methods=['GET', 'POST'])
+def upload_file():
+ if request.method == 'POST':
+ # check if the post request has the file part
+ if 'file' not in request.files:
+ flash('No file part')
+ return redirect(request.url)
+ if 'data' not in request.form:
+ flash("No string input")
+ file = request.files['file']
+ if file:
+ if file.filename == '':
+ flash('No selected file')
+ return redirect(request.url)
+ try:
+ binary = subprocess.check_output(
+ "./bmpencode /dev/stdin /dev/stdout {}".format(shlex.quote(request.form['data'])),
+ stdin=file.stream,
+ stderr=subprocess.PIPE,
+ shell=True
+ )
+ response = make_response(binary)
+ response.headers.set('Content-Type', 'image/bmp')
+ response.headers.set('Content-Disposition', 'attachment', filename='encoded.bmp')
+ return response
+ except subprocess.CalledProcessError as e:
+ return e.stderr
+ return '''
+ <!doctype html>
+ <title>Hide Text in a BMP</title>
+ <h1>Upload new File</h1>
+ <form method=post enctype=multipart/form-data>
+ <input type=file name=file>
+ <input type=text name=data>
+ <input type=submit value=Upload>
+ </form>
+ '''
diff --git a/stegtoy/bmpencode.c b/stegtoy/bmpencode.c
new file mode 100644
index 0000000..731693a
--- /dev/null
+++ b/stegtoy/bmpencode.c
@@ -0,0 +1,98 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/stat.h>
+
+#define FLAG "UMASS{f1l3f0rm4754r3h4rd_r3m3mb3rh34r7bl33d}"
+
+int main(int argc, char **argv)
+{
+ struct stat st;
+ const char *path_in, *path_out, *data;
+ char *buf, *output, *flag;
+ size_t file_size, data_len;
+ FILE *fp;
+ int i;
+
+ int32_t data_start;
+ uint32_t compression, image_size;
+
+ flag = malloc(strlen(FLAG) + 1);
+ strcpy(flag, FLAG);
+
+ if (argc != 4) {
+ fprintf(stderr, "usage: %s [in] [out] [data]\n", argv[0]);
+ return 1;
+ }
+
+ path_in = argv[1]; path_out = argv[2]; data = argv[3];
+
+ stat(path_in, &st);
+ file_size = st.st_size;
+
+ buf = malloc(file_size);
+
+ fp = fopen(path_in, "rb");
+ if (fp == NULL) {
+ fprintf(stderr, "%s: no such file\n", path_in);
+ return 2;
+ }
+
+ fread(buf, file_size, 1, fp);
+ fclose(fp);
+
+ // Here's where the actual parsing
+ if (buf[0] != 'B' || buf[1] != 'M') {
+ fprintf(stderr, "%s: not a valid BMP\n", path_in);
+ return 3;
+ }
+
+ compression = *((uint32_t *) (buf + 0x1e));
+ if (compression != 0) {
+ fprintf(stderr, "%s: no support for compressed BMP\n", path_in);
+ return 4;
+ }
+
+ data_start = *((int32_t *) (buf + 0xa));
+ image_size = *((uint32_t *) (buf + 0x22));
+
+ output = malloc(0x6 + 0x28 + image_size);
+ output[0] = 'B'; // Header
+ output[1] = 'M';
+ *((uint32_t *) (output + 0x2)) = 0x6 + 0x28 + image_size; // File size
+ *((uint32_t *) (output + 0xa)) = 0x36; // Data start
+ *((uint32_t *) (output + 0xe)) = 0x28; // Header size
+ *((uint32_t *) (output + 0x12)) = *((uint32_t *) (buf + 0x12)); // Width
+ *((uint32_t *) (output + 0x16)) = *((uint32_t *) (buf + 0x16)); // Height
+ *((uint16_t *) (output + 0x1a)) = 1; // nb plan
+ *((uint16_t *) (output + 0x1c)) = 24; // bpp
+ *((uint32_t *) (output + 0x1e)) = 0; // compression
+ *((uint32_t *) (output + 0x22)) = image_size; // Image size
+
+ // Here's the vuln.
+ memcpy(output + 0x36, buf + data_start, image_size);
+
+ data_len = strlen(data);
+ for (i = 0; i < image_size - 8 && i < data_len; i += 8) {
+ output[0x36 + i + 0] = output[0x36 + i + 0] & 254 | ((data[i] & (1 << 7)) >> 7);
+ output[0x36 + i + 1] = output[0x36 + i + 1] & 254 | ((data[i] & (1 << 6)) >> 6);
+ output[0x36 + i + 2] = output[0x36 + i + 2] & 254 | ((data[i] & (1 << 5)) >> 5);
+ output[0x36 + i + 3] = output[0x36 + i + 3] & 254 | ((data[i] & (1 << 4)) >> 4);
+ output[0x36 + i + 4] = output[0x36 + i + 4] & 254 | ((data[i] & (1 << 3)) >> 3);
+ output[0x36 + i + 5] = output[0x36 + i + 5] & 254 | ((data[i] & (1 << 2)) >> 2);
+ output[0x36 + i + 6] = output[0x36 + i + 6] & 254 | ((data[i] & (1 << 1)) >> 1);
+ output[0x36 + i + 7] = output[0x36 + i + 7] & 254 | ((data[i] & (1 << 0)) >> 0);
+ }
+
+ fp = fopen(path_out, "wb+");
+ if (fp == NULL) {
+ fprintf(stderr, "%s: could not write\n", path_out);
+ return 5;
+ }
+ fwrite(output, 0x6 + 0x28 + image_size, 1, fp);
+ fclose(fp);
+
+ free(buf);
+ return 0;
+}
generated by cgit v1.3 (git 2.53.0) at 2026-08-29 14:29:47 +0000