Jump to content
Sign in to follow this  
Followers 0

Steganography in Linux

2 posts in this topic

Recommended Posts

Hi fellows! I bring a tutorial about steganography, made by myself, the art of concealing things in plain sight! (text files within pictures or sound files) :D


I think this should apply to Mac OS X, there you can use a GUI program called "Steg"

This tut is for Linux only!



It is a very straightforward process,

Hope you learn howto do it and put it to good use hahhaha

Share this post

Link to post
Share on other sites

:hysterical:  You've only just discovered this stuff? 'just took a course or something?  :lol:


In our modern (but more and more ancient) computerised world, this sort of things has been around for (a few...) years and there must be thousands of tuts and video recordings or referencing on the Internet about this, including about steghide! Example: https://www.maketecheasier.com/hide-confidential-data-inside-images-in-linux/


Under OS X/macOS a simple file concatenation line command will achieve this. Example as explained here:

  1. you have a png picture file called Picture.png
  2. you have a text file called Secret_stuff.txt
  3. you can hide the text file inside a new picture file with Terminal command: cat Picture.png Secret_stuff.txt > NewPix.png
  4. you will obtain what will look like a mirror copy of your original png picture file that you can open & display on screen through doubleclick

Here's a video tut from a few years ago for Windows which is very similar to yours (a simple binary mode copy command does the trick there).


For Mac, there indeed used to be something called iSteg: http://www.hanynet.com/isteg/


As for steghide, 'not the freshest thing around either (no offense to its author meant)!  :w00t: e.g.: https://linuxfr.org/news/steghide-en-français from... 2002! Windows was XP and Mac OS X was Puma on Power Macintosh in those days.


In fact, most of the literature on steghide, including your post, doesn't entirely describe what it is and/or give credits to its author, Stefan Helz. The program might be open source and 15yr old but, nevertheless, it's not a built-in Linux Terminal command as kind of often hinted, probably because it's directly available as a downloadable package to most Linux distros (through apt-get install command)... Like many before you, you've listed and described the syntax of the steghide command without even referring to the (on-line) user manual it's literally copied from. C'est la vie...



I'm sure you meant well with your tutorial but you should always care to quote your sources, give due credits and not sail too late after the tide (15years is a tad late). :whistle: Maybe teachers still use this in their classrooms.



Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By CuriousTommy
      I am trying to get my MacOS (High Serria) virtual machine to communicate with my host (Fedora 27) on an isolated network bridge. The VM runs on a QEMU, and I created an isolated network bridge on Linux using Virt Manager.
        Normally, there are two networks that are connected to the VM, the public network (where the VM can see other local devices and access the network on the internet) and an isolated network (where my guests and host can communicate between each other but can't see anything else).   If I try to access my Mac VM through the public network, it works just fine. However, when I try with the isolated network, it never works. I even tried to make the public network inactive to see if I can force MacOS to use the isolated network, but that didn't help.   I was able to get a Linux/Windows guest VM to communicate between the isolated bridge, but for some reason, I just can't figure out why it is not working on MacOS.   Attached below is a picture of how I configured the Isolated Network on MacOS:
    • By kosakgroove
      More info at: http://www.thegroovykosak.blogspot.pt   Here is a video I made demonstrating the procedure.   https://www.youtube.com/watch?v=04SLD2Kft60     Download your distro of choice, in my case Ubuntu Gnome edition   Once that is done, use the command that follows to convert the iso to img: 
hdiutil convert -format UDRW ~/path/to/target.iso -o ~/path/to/ubuntu.img 
Note: OS X tends to put the .dmg ending on the output file automatically, delete the ".dmg" ending.   Run diskutil list to get the current list of devices   Insert your flash media   Run diskutil list again and determine the device node assigned to your flash media
(e.g. /dev/disk2)   Run
 diskutil unmountDisk /dev/diskN 
(replace N with the disk number from the last command; in the previous example, Nwould be 2)   Execute the following command while replacing /path/to/downloaded.img with the path where the image file is located; for example, ./ubuntu.img or ./ubuntu.dmg).   sudo dd if=/path/to/downloaded.img of=/dev/rdiskN bs=1m   Using /dev/rdisk instead of /dev/disk may be faster.   Run diskutil eject /dev/diskN and remove your flash media when the command completes   Restart your Mac and press Alt while the Mac is restarting to choose the USB-Stick or restart your PC and choose the USb from BIOS. This USB should work for any computer.   Note: (If you see the error dd: Invalid number '1m', you are using GNU dd. Use the same command but replace bs=1m with bs=1M. If you see the error dd:/devdiskN: Resource busy, make sure the disk is not in use. Start the Disk Utility.app and unmount (don't eject) the drive. )
        Thanks for watching        
    • By Lanza
      Hello all,
      I have been using a Hackintosh for some time now, and everithing's ok on th mac side. I had dual boot with my own LFS until now, which I dropped and replaced with Arch Linux because I cannot maintain it anymore.
      I used my LFS kernel from its root ext4 partition using VBoxExt4fs-64 without any problem for 1 year.
      The issue I'm facing is that after reformating the root ext4 partition of my linux to install Arch and adjusting my config.plist (Kernel Arguments) accordingly, clover fails to detect it, and won't even check if there is something to load there. As for now I've copied my Kernel in EFI partition, but i'm not satisfied with this solution that leads me to some dirty quirks. PARTUUID is still the same.

      What is required for VBoxExt4 to stop ignoring my partition ?
      Here is my custom entries in config.plist
      <key>Custom</key> <dict> <key>Entries</key> <array> <dict> <key>FullTitle</key> <string>Arch Linux</string> <key>Volume</key> <string>A2D9F051-6191-4ABC-A873-5822A1DA9816</string> <key>Type</key> <string>LinuxKernel</string> <key>Arguments</key> <string>root=UUID=4b502e58-c898-41c9-8668-a916919d5bea rw add_efi_memmap initrd=/boot/initramfs-linux.img</string> <key>Image</key> <string>os_linux.icns</string> </dict> <dict> <key>FullTitle</key> <string>OS X El Capitan (Version 10.11)</string> <key>Volume</key> <string>C7148FAA-7CB9-43C2-A6FB-D99C653A7D42</string> <key>Type</key> <string>OSX</string> <key>Arguments</key> <string>dart=0 kext-dev-mode=1</string> <key>Image</key> <string>os_elcapitan.icns</string> <key>InjectKexts</key> <string>Yes</string> <key>CustomLogo</key> <true/> </dict> </array> </dict> And there are interesting parts of my clover log :

      found 21 volumes with blockIO ... 0:995 0:001 PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x1,0xFFFF,0x0)\HD(3,GPT,9DE5967B-C207-469C-819B-5F22D87D0222,0x2010000,0xCD43800) 0:999 0:003 15. Volume: 1:000 0:001 PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x1,0xFFFF,0x0)\HD(4,GPT,A2D9F051-6191-4ABC-A873-5822A1DA9816,0xED53800,0xEF9F800) 1:007 0:006 16. Volume: ... 1:183 0:002 Custom entry 0 FullTitle:"Arch Linux" Options:"root=UUID=4b502e58-c898-41c9-8668-a916919d5bea rw add_efi_memmap initrd=/boot/initramfs-linux.img" Type:5 Flags:0x10 matching Volume:"PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x1,0xFFFF,0x0)\HD(4,GPT,A2D9F051-6191-4ABC-A873-5822A1DA9816,0xED53800,0xEF9F800)" 1:197 0:013 Checking volume "Musique Temporai" (PciRoot(0x0)\Pci(0x14,0x0)\USB(0x13,0x0)\HD(1,MBR,0xE603CB45,0x800,0x3A384800)) ... skipped 1:202 0:005 Checking volume "ARCHISO_EFI" (PciRoot(0x0)\Pci(0x14,0x0)\USB(0x6,0x0)\HD(1,MBR,0x38AB083F,0xAC,0x14000)) ... skipped because volume is hidden 1:206 0:004 Checking volume "EFI" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x0,0xFFFF,0x0)\HD(1,GPT,3101EE12-C682-411C-A58F-2ECF00F32038,0x28,0x64000)) ... skipped because volume is hidden 1:212 0:005 Checking volume "Macintosh SSD" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x0,0xFFFF,0x0)\HD(2,GPT,C7148FAA-7CB9-43C2-A6FB-D99C653A7D42,0x64028,0xECE2340)) ... skipped 1:218 0:006 Checking volume "Recovery HD" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x0,0xFFFF,0x0)\HD(3,GPT,A86E0422-A10B-4018-8BB7-E11650A18B78,0xED46368,0x135F20)) ... skipped because volume is hidden 1:223 0:005 Checking volume "EFI" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x1,0xFFFF,0x0)\HD(1,GPT,F0C44C38-3B25-4316-A730-222A5180AD00,0x28,0x64000)) ... skipped because volume is hidden 1:229 0:005 Checking volume "Home" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x1,0xFFFF,0x0)\HD(3,GPT,9DE5967B-C207-469C-819B-5F22D87D0222,0x2010000,0xCD43800)) ... skipped 1:233 0:004 Checking volume "EFI" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x3,0xFFFF,0x0)\HD(1,GPT,453EB6EA-8235-43A8-A764-50116EE77F0D,0x28,0x64000)) ... skipped because volume is hidden 1:239 0:006 Checking volume "Macintosh HD" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x3,0xFFFF,0x0)\HD(2,GPT,8D2FAC22-3EF3-4DA5-8230-1C6AF349EB18,0x64028,0x3A3613A8)) ... skipped 1:246 0:006 Checking volume "Data" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x3,0xFFFF,0x0)\HD(6,GPT,839884B3-8475-44B1-8515-C8E305279E92,0x3A4FB800,0x7458C000)) ... skipped 1:250 0:004 Checking volume "EFI" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x5,0xFFFF,0x0)\HD(1,GPT,E4C9852F-E33D-4340-9EAE-10270B1021DA,0x28,0x64000)) ... skipped because volume is hidden 1:256 0:005 Checking volume "Partage" (PciRoot(0x0)\Pci(0x1F,0x2)\Sata(0x5,0xFFFF,0x0)\HD(2,GPT,7AE38813-1944-44E4-A2C4-469E57618068,0x64028,0x3A2E1FE0)) ... skipped 1:262 0:006 Custom entry 1 FullTitle:"OS X El Capitan (Version 10.11)" Path:"\System\Library\CoreServices\boot.efi" Options:"dart=0 kext-dev-mode=1" Type:1 Flags:0x12 matching Volume:"C7148FAA-7CB9-43C2-A6FB-D99C653A7D42" ... 1:395 0:003 Scanning loaders... 1:397 0:002 0: 'Whole Disc Boot' no file system 1:402 0:004 1: 'Musique Temporai' 1:445 0:042 2: 'Whole Disc Boot' no file system 1:449 0:004 3: 'ARCHISO_EFI' hidden 1:455 0:005 4: 'Whole Disc Boot' no file system 1:460 0:004 5: 'Whole Disc Boot' no file system 1:464 0:004 6: 'Whole Disc Boot' no file system 1:470 0:006 7: 'Whole Disc Boot' no file system 1:476 0:005 8: 'Whole Disc Boot' no file system 1:481 0:004 9: 'EFI' hidden 1:485 0:004 10: 'Macintosh SSD' 1:491 0:006 AddLoaderEntry for Volume Name=Macintosh SSD 1:493 0:001 hiding entry: \System\Library\CoreServices\boot.efi 1:504 0:011 11: 'Recovery HD' hidden 1:508 0:003 12: 'EFI' hidden 1:512 0:004 13: 'Legacy HD2' no file system 1:517 0:005 14: 'Home' 1:532 0:014 15: 'Legacy HD4' no file system 1:537 0:005 16: 'EFI' hidden 1:541 0:004 17: 'Macintosh HD' 1:629 0:087 AddLoaderEntry for Volume Name=Macintosh HD 1:631 0:001 hiding entry: \System\Library\CoreServices\boot.efi 1:642 0:011 18: 'Data' 1:653 0:011 19: 'EFI' hidden 1:657 0:003 20: 'Partage' ... Part UUID A2D9F051-6191-4ABC-A873-5822A1DA9816 aka block ID 15 should NOT appear as
      "15 : 'Legacy HD4' no file system"
      Hence Clover do not even try to find a kernel, since it does not detect ext4 on this partition.

      'Home' is ext4 too and is detected, and checked by clover. Why not my root partition ?


      Edit : blkid of the partition :
      /dev/sdb4: LABEL="Arch Linux" UUID="4b502e58-c898-41c9-8668-a916919d5bea" TYPE="ext4" PARTLABEL="ArchLinux" PARTUUID="a2d9f051-6191-4abc-a873-5822a1da9816"
    • By Scr3w1912
      Ciao a tutti, vi scrivo questa mini-guida, o se vogliamo "istruzioni per noobs" su come si crea una chiavetta USB avviabile da UEFI con Ubuntu (Per Yosemite-Zone) in modo manuale.
      Per molti sarà inutile perché per Windows e OSX ci sono dei tools che fanno questo procedimento in automatico, siccome per Linux non ci sono queste comodità (e io non ho trovato istruzioni su Google), ecco qui come io ho fatto:
      Chiavetta USB da 8 GB (Minimi) Yosemite-Zone.iso Ubuntu hfsprogs (sudo apt-get install hfsprogs) gparted (sudo apt-get install gparted) l'ultima Immagine ISO di Clover UEFI (https://sourceforge.net/projects/cloverefiboot/files/Bootable_ISO/) Procedimento: (Attenzione: questo metodo cancellerà tutti i dati sulla chiavetta)
      Avviate GParted con i privilegi di Root (sudo gparted) In alto a destra c'è la selezione del dispositivo da modificare, ammesso che abbiate solo una chiavetta collegata al PC selezionate "/dev/sdb" Comparirà la lista delle partizioni della chiavetta, con il proprio ID, (ES: sdb1, sdb2 etc) se una qualsiasi partizione è stata montata da Ubuntu dovete smontarla (essa apparirà con una chiave affianco al nome) premete il tasto destro sulla partizione e nel menù che esce premete su "Smonta" Spostatevi nel menù di GParted, selezionate "Dispositivo" e poi "Crea Tabella Partizioni", Uscirà una finestra con il tipo di Scheda da utilizzare, noi dobbiamo scegliere GPT altrimenti la chiavetta non verrà riconosciuta da UEFI, Applicate le modifiche premendo il tasto Applica di Gparted. Ora avremo 8GB di spazio "non allocato" dobbiamo creare 2 partizioni una per Clover e una per Yosemite-Zone Iniziamo con quella per Clover, selezionate lo "spazio non allocato", tasto destro, nuovo, come "Nuova dimensione" mettete 300 MiB, "Filesystem" selezionate "FAT32" e come Nome dategli "Clover" il resto potete lasciare così com'è Ora tocca a quella per Yosemite-Zone, Create una nuova partizione con tutto lo spazio che avanza e selezionate il Filesystem "HFS+" e come nome Yosemite-Zone (I nomi non incidono sulla riuscita dell'operazione, servono solo per non avere mille "untitled" Applicate tutte le modifiche effettuate e uscite dal programma Ora dobbiamo copiare i Files di Clover e Yosemite-Zone nelle partizioni appena create. Partiamo da Clover, esso andrà nella partizione da 300 MiB, quella etichettata come "Clover" (ma dai?) quindi, montiamo il File Clover-xxxx-X64.Iso (Le X dipendono dalla versione del software), su Ubuntu basta cliccare il file e verrà automaticamente montato; Quindi, copiate tutti i Files dell'iso di Clover nella partizione della Chiavetta da 300 MiB Ora tocca a Yosemite-Zone.sio e qui il procedimento diventa un po' più ostico; Innanzitutto dobbiamo ri-montare la partizione della chiavetta creata precedentemente in modalità "Read-Write", (Di default Ubuntu monta HFS+ in "Read-Only") quindi aprite il Terminare e digitate: "sudo mkdir /mnt/temp" poi: "sudo mount -o force -t hfsplus /dev/sdb2 /mnt/temp". Ora aprite una nuova finestra del Terminale e digitate: "sudo nautilus" ora usando questa finestra del gestore dei files con privilegi di Root, montate la iso di Yosemite-Zone (doppio click su di essa) e copiate tutti i files dalla .iso alla partizione della chiavetta Una volta completato il procedimento potete staccare tutto, riavviare e avviare la chiavetta USB da UEFI, si avvierà Clover, e da esso potrete avviare l'installer di OSX.
    • By soydemadrid
      Hi I hope someone can please help. My previously working vmware image of Mac OSx no longer boots in Ubuntu 15.10. I've re-applied the unlocker and patches but I can't get it to work.
      The Apple logo appears and the progress bar gets to half way across (albeit very very slowly) and then gets no further.
      Is there any way to see the boot process and where it gets stuck or what the error is? Thanks for any help at all.