Skip to content

Instantly share code, notes, and snippets.

@dawksh
Created November 3, 2025 19:24
Show Gist options
  • Select an option

  • Save dawksh/8d8c65bf3940fadd371c15aed340be61 to your computer and use it in GitHub Desktop.

Select an option

Save dawksh/8d8c65bf3940fadd371c15aed340be61 to your computer and use it in GitHub Desktop.
pgm 7
steghide zip clamav
----------------------------
#!/bin/bash
set -euo pipefail
echo "[*] script start: $(date)"
TMPDIR="$(mktemp -d /tmp/exfil.XXXXXX)"
SRC="${HOME}/acq_demo/victim_docs/secret.txt"
cp "${SRC}" "${TMPDIR}/secret.txt"
zip -j -P pass123 "${TMPDIR}/payload.zip" "${TMPDIR}/secret.txt"
mkdir -p /tmp/exfil
cp "${TMPDIR}/payload.zip" /tmp/exfil/payload.zip
echo "[*] script end: $(date)"
----------------------------
steghide embed -cf ~/acq_demo/cover1.jpg -ef /tmp/exfil/payload.zip -p demo-pass
steghide info ~/acq_demo/cover1.jpg
----------------------------
mkdir -p ~/.hidden_store
mv ~/acq_demo/cover1.jpg ~/.hidden_store/.cover1.jpg
ls -la ~/.hidden_store
# Extract hidden file
steghide extract -sf ~/.hidden_store/.cover1.jpg -p demo-pass -xf /tmp/recovered_payload.zip
# Unzip and recover secret
unzip -P pass123 /tmp/recovered_payload.zip -d /tmp/recovered_payload
cat /tmp/recovered_payload/secret.txt
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment