Image Steg in Python
Steganography - This is the process of hiding information within JPEG files. More specifically, when applied to image files, it's referred to as image steganography.
Structure of JPEG Files
Let’s first examine the structure of an image using a hex editor. In my case, I am using the HxD editor.
Get any JPEG image you have, for me I will download one from the Mr.Robot show(favorite film of all time):https://resizing.flixster.com/_IPFL-_cXmQIP8v3YtIXJKNlK8c=/206x305/v2/https://resizing.flixster.com/-XZAfHZM39UwaGJIFWKAE8fS0ak=/v3/t/assets/p11710290_b_v8_aa.jpg
Now load the image you have selected into the HxD editor: Go to files->open->image.jpg
After loading the image onto the editor, one thing you will notice is that the image starts with the sequence “FF D8” and the last sequence, when you scroll down to the bottom, is “FF D9”.
The sequence repeats when you open up multiple JPEG files in the editor.
This is the important part: “FF D9”, as it tells any program processing JPEG files that it’s the end of the file. This gives us the advantage we need, as we can now add our information into the file without affecting the image’s functionality.
1 Hiding Information
Let's start now by hiding a simple information, such as “Hello World”, into a JPEG image file in Python.
In the above, we load the image in our program in append bytes(ab) and use the write method to append the bytes of the string “Hello World”.
Next, run the python program on the shell
cmd>> main.py
Now let's load our image after adding the message into the hex editor and observe what has changed.
In the above screenshot, we can see that “FF D9” is no longer the last part of the file; instead, additional hex values have been appended to include our message “Hello World.” As previously stated, the image will still open and will not be affected by embedding our message.
Extracting our information
The above Python code is used to extract information from the JPEG file.
We first load our image in read-binary mode and save the bytes into a variable. Next, we locate the end of the JPEG file and use that to print whatever comes after the end-of-file bytes, which is our embedded message: “Hello World.”
Run:
cmd>> python extract_infor.py
2 Hiding Images in JPEG files
Now let's take a PNG image and add it inside our JPEG files. We will embed the PNG image data within our JPEG image.
Let’s install the required libraries first:
cmd>> pip install pillow
QuickNote: Make sure to remove the added message from the JPEG file in the hex editor or use another JPEG image.
Code:
- We import the required libraries, pillow, and io.
- Load the PNG file using Pillow and save the image bytes to byte_arr using the io library we imported.
- Finally, open our JPEG image in append binary format, then add the PNG bytes into it.
Run:
cmd>> python embed_image.py
When opened, the JPEG image remains the same, and the file’s functionality is not affected.
Now let's open the JPEG file in the hex editor and check what has changed.
Get own_the_net’s stories in your inbox
Join Medium for free to get updates from this writer.
On the hex editor, go to search->find->Hex-Values
Use the Hex-Values to find the last hex value for the JPEG file.
Extract Image
- We import the libraries: Pillow and io.
- Now load the JPEG file containing our PNG image data.
- Save the JPEG file bytes into the variable “content” which we will use to get the last JPEG bytes occurrence.
- Extract the bytes that come after the JPEG file bytes and use them to create our new image called “extracted_image.png”
Run:
cmd>> python extract_png.py
Great for making this far!!
3 Hiding Executables in JPEG Files
In this final part, let’s take a simple executable file, embed it into a JPEG file, observe that nothing has changed in the image’s appearance, then extract the executable and run it.
In my case, I will compile a simple C++ program that “adds two numbers” into a standalone executable. You can use DevC++ for this or VS Code.
My C++ Code:
When you run the code in DevC++, it automatically compiles the code to a standalone executable.
Save the .exe file to the same folder as our JPEG file.
For this, let's use a new JPEG file.
Python Code:
Run the program:
cmd>> python hiding_executable.py
Like we previously did, you can now check what has changed in the hex editor on your own now😁.
Extracting our executable
You can delete the .exe from the folder first before we extract it from the image.
- Load the JPEG file containing our executable in read bytes
- Extract the executable bytes from the file.
- Create a new file “run_me.exe”
- Add the executable bytes into the file
Run:
cmd>> python executable_extract.py
Let's test our executable and see if it works:
Congratulations, you can now transport executables using an image file.
Conclusion
The above concept can be applied in capture the flags or red team operations, such as building a command and control server. You are only limited by your imagination.
“Every secret creates a potential failure point.”
