generators/compression/zip (takes strings_to_leak) & generators/challenges/hidden_zip_in_image_file (takes a zip file + concats)

Gemfile

@@ -11,6 +11,7 @@ gem 'rqrcode'
 gem 'mini_exiftool_vendored'
 gem 'rmagick'
 gem 'sshkey'
+gem 'zipruby'
 
 #development only gems go here
 group :test, :development do

Gemfile.lock

@@ -60,6 +60,7 @@ GEM
     wordlist (0.1.1)
       spidr (~> 0.2)
     yard (0.8.7.6)
+    zipruby (0.3.6)
 
 PLATFORMS
   ruby
@@ -80,6 +81,7 @@ DEPENDENCIES
   sshkey
   wordlist
   yard
+  zipruby
 
 BUNDLED WITH
    1.14.3

modules/generators/challenges/hidden_strings_in_image_file/secgen_local/local.rb

@@ -1,13 +1,13 @@
 #!/usr/bin/ruby
 require_relative '../../../../../lib/objects/local_string_encoder.rb'
 
-class HideDataInImgChallenge < StringEncoder
+class HideStringsInImgChallenge < StringEncoder
   attr_accessor :base64_image
   attr_accessor :strings_to_leak
 
   def initialize
     super
-    self.module_name = 'Hidden Data in Image File Challenge Generator'
+    self.module_name = 'Hidden Strings in Image File Challenge Generator'
     self.base64_image = ''
     self.strings_to_leak = []
   end
@@ -44,4 +44,4 @@ class HideDataInImgChallenge < StringEncoder
   end
 end
 
-HideDataInImgChallenge.new.run
+HideStringsInImgChallenge.new.run

modules/generators/challenges/hidden_strings_in_image_file/secgen_metadata.xml

@@ -3,7 +3,7 @@
 <generator xmlns="http://www.github/cliffe/SecGen/generator"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://www.github/cliffe/SecGen/generator">
-  <name>Hidden Data in Image File</name>
+  <name>Hidden Strings in Image File</name>
   <author>Thomas Shaw</author>
   <module_license>MIT</module_license>
   <description>Makes use of a random image, encodes a string_to_leak (flag) then inserts the data to decode into the end

modules/generators/challenges/hidden_zip_in_image_file/secgen_local/local.rb

@@ -0,0 +1,48 @@
+#!/usr/bin/ruby
+require_relative '../../../../../lib/objects/local_string_encoder.rb'
+
+class HideZipInImgChallenge < StringEncoder
+  attr_accessor :base64_image
+  attr_accessor :zip_file
+
+  def initialize
+    super
+    self.module_name = 'Hidden Zip in Image File Challenge Generator'
+    self.base64_image = ''
+    self.zip_file = ''
+  end
+
+  def encode_all
+    # Decode the base64 image data into raw contents
+    raw_image_contents = Base64.strict_decode64(self.base64_image)
+    raw_zip_contents = Base64.strict_decode64(self.zip_file)
+
+    # Append data to the end of the file
+    contents_with_data = raw_image_contents + raw_zip_contents
+
+    # Re-encode in base64 and return
+    self.outputs << Base64.strict_encode64(contents_with_data)
+  end
+
+  def get_options_array
+    super + [['--base64_image', GetoptLong::REQUIRED_ARGUMENT],
+            ['--zip_file', GetoptLong::REQUIRED_ARGUMENT]]
+  end
+
+  def process_options(opt, arg)
+    super
+    case opt
+      when '--base64_image'
+        self.base64_image << arg;
+      when '--zip_file'
+        self.zip_file << arg;
+    end
+  end
+
+  def encoding_print_string
+    'base64_image: <selected_image>
+     zip_file: ' + self.zip_file.to_s
+  end
+end
+
+HideZipInImgChallenge.new.run

modules/generators/challenges/hidden_zip_in_image_file/secgen_metadata.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+
+<generator xmlns="http://www.github/cliffe/SecGen/generator"
+           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+           xsi:schemaLocation="http://www.github/cliffe/SecGen/generator">
+  <name>Hidden Zip in Image File</name>
+  <author>Thomas Shaw</author>
+  <module_license>MIT</module_license>
+  <description>Makes use of a random image, encodes a string_to_leak (flag) then inserts the data to decode into the end
+    of the image file in ascii.
+  </description>
+
+  <type>hidden_zip_in_image_file</type>
+  <type>image_generator</type>
+  <type>image_challenge_generator</type>
+  <type>local_calculation</type>
+  <platform>linux</platform>
+  <platform>windows</platform>
+
+  <hint>Inspect the file's raw hex. Look at end for something to decode. Example tools: hexedit/hexeditor</hint>
+
+  <read_fact>base64_image</read_fact>
+  <read_fact>zip_file</read_fact>
+
+  <default_input into="base64_image">
+    <generator type="random_image"/>
+  </default_input>
+
+  <default_input into="zip_file">
+     <generator type="zip_file"/>
+  </default_input>
+
+  <output_type>generated_image</output_type>
+</generator>

modules/generators/compression/zip/secgen_local/local.rb

@@ -0,0 +1,51 @@
+#!/usr/bin/ruby
+require_relative '../../../../../lib/objects/local_string_encoder.rb'
+require 'rubygems'
+require 'zip'
+
+class ZipFileGenerator < StringEncoder
+  attr_accessor :file_name
+  attr_accessor :strings_to_leak
+
+  def initialize
+    super
+    self.module_name = 'Zip File Generator'
+    self.file_name = ''
+    self.strings_to_leak = []
+  end
+
+  def encode_all
+    zip_file_path = GENERATORS_DIR + 'compression/zip/secgen_local/archive.zip'
+
+    Zip::File.open(zip_file_path, Zip::File::CREATE) do |zip_file|
+      zip_file.get_output_stream(self.file_name) { |os|
+        os.write self.strings_to_leak.join("\n")
+      }
+    end
+
+    file_contents = File.binread(zip_file_path)
+    self.outputs << Base64.strict_encode64(file_contents)
+  end
+
+  def get_options_array
+    super + [['--file_name', GetoptLong::REQUIRED_ARGUMENT],
+             ['--strings_to_leak', GetoptLong::REQUIRED_ARGUMENT]]
+  end
+
+  def process_options(opt, arg)
+    super
+    case opt
+      when '--file_name'
+        self.file_name << arg;
+      when '--strings_to_leak'
+        self.strings_to_leak << arg;
+    end
+  end
+
+  def encoding_print_string
+    'file_name: ' + self.file_name.to_s +
+    'file_contents: ' + self.strings_to_leak.to_s
+  end
+end
+
+ZipFileGenerator.new.run

modules/generators/compression/zip/secgen_metadata.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+
+<generator xmlns="http://www.github/cliffe/SecGen/generator"
+           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+           xsi:schemaLocation="http://www.github/cliffe/SecGen/generator">
+  <name>Zip File Generator</name>
+  <author>Thomas Shaw</author>
+  <module_license>MIT</module_license>
+  <description>TODO</description>
+
+  <type>zip_file</type>
+  <type>zip_file_generator</type>
+  <platform>linux</platform>
+  <platform>windows</platform>
+
+  <read_fact>file_name</read_fact>
+  <read_fact>strings_to_leak</read_fact>
+
+  <default_input into="file_name">
+    <value>flag.txt</value>
+  </default_input>
+
+  <default_input into="strings_to_leak">
+    <generator type="flag_generator"/>
+  </default_input>
+
+  <output_type>zip_file</output_type>
+</generator>