All Entries Tagged With: "files"
Embedding and Hiding Files in PDF Documents
From Didier Stevens: http://hacksec.blisque.com/
My corrupted PDF quip inspired me to program another steganography trick: embed a file in a PDF document and corrupt the reference, thereby effectively making the embedded file invisible to the PDF reader.
The PDF specification provides ways to embed files in PDF documents. I’m releasing my Python program to create a PDF file with embedded file (I used make-pdf-embedded.py to create my EICAR.pdf).
Here’s how a PDF document with an embedded file looks like:
/EmbeddedFiles points to the dictionary with the embedded files:
As names defined in the PDF specification are case sensitive, changing the case changes the semantics: /Embeddedfiles has no meaning, and thus the PDF reader ignores it and doesn’t find the embedded file.
Actually, I used this trick in my Brucon puzzle. I used the –stego option of make-pdf-embedded.py:
Of course, once you know the stego trick, it’s easy to recover the embedded file: edit the PDF document with an hex editor and change the case back to /EmbeddedFiles.
But if you want to make it harder to detect, use PDF obfuscation techniques. Or embed the file twice with incremental updates. First version is the file you want to hide, second version is a decoy…
The PDF language offers so many features to hide and obfuscate data!
Download:
make-pdf_V0_1_2.zip (150)Hide RAR files in a PNG image
This is an interesting one I found on Shell Fu this morning. It’s similar to my previous post of hiding a .exe in a text file. They both have there uses.
It is possible to hide a rar archive inside a png image file and then retrieve the files from the image.
cat picture.png archive.rar > hidden_archive_in_pic.png
This can also be done on Windows:
copy picture.png + archive.rar hidden_archive_in_pic.png
When you want to retrieve the hidden files, download the image, rename to .rar and extract.
