Lab 5: String & Metadata Analysis - Menggali Informasi Tersembunyi dari File

sudo apt install -y binwalk exiftool file xxd

cd ~ && mkdir forensics-lab5 && cd forensics-lab5

# Buat file gambar dengan data tersembunyi di dalamnya
# Teknik: append data setelah akhir file JPEG
echo "=== HIDDEN DATA ===" > /dev/null
python3 -c "
# Buat file PNG sederhana dengan hidden data
import struct, zlib

# Minimal PNG: signature + IHDR + IDAT + IEND
def create_minimal_png(width=1, height=1):
    sig = b'\\x89PNG\\r\\n\\x1a\\n'
    
    # IHDR
    ihdr_data = struct.pack('>IIBBBBB', width, height, 8, 2, 0, 0, 0)
    ihdr_crc = zlib.crc32(b'IHDR' + ihdr_data) & 0xffffffff
    ihdr = struct.pack('>I', 13) + b'IHDR' + ihdr_data + struct.pack('>I', ihdr_crc)
    
    # IDAT (dummy)
    raw_data = b''
    for y in range(height):
        raw_data += b'\\x00' + b'\\x00\\x00\\x00' * width
    compressed = zlib.compress(raw_data)
    idat_crc = zlib.crc32(b'IDAT' + compressed) & 0xffffffff
    idat = struct.pack('>I', len(compressed)) + b'IDAT' + compressed + struct.pack('>I', idat_crc)
    
    # IEND
    iend_crc = zlib.crc32(b'IEND') & 0xffffffff
    iend = struct.pack('>I', 0) + b'IEND' + struct.pack('>I', iend_crc)
    
    return sig + ihdr + idat + iend

png_data = create_minimal_png()

# Append sensitive data AFTER PNG end marker
hidden = b'\\n\\n===RAHASIA=== Password DB = root@localhost:SuperSecret2024\\nIP Server Internal = 10.0.0.1\\nAPI_KEY = sk-live-abc123def456\\n===END RAHASIA===\\n'

with open('foto-produk.png', 'wb') as f:
    f.write(png_data + hidden)

print('✅ foto-produk.png created with hidden data')
print(f'   Size: {len(png_data) + len(hidden)} bytes')
"

# 1. File identification
echo "=== File Type ==="
file foto-produk.png

# 2. Strings - cari semua teks yang bisa dibaca
echo ""
echo "=== Strings (semua) ==="
strings foto-produk.png

# 3. Strings - filter yang mengandung keyword sensitif
echo ""
echo "=== Strings - Password & Key ==="
strings foto-produk.png | grep -iE "(password|api[_-]?key|secret|token|rahasia)"

# 4. Strings - filter IP address
echo ""
echo "=== Strings - IP Address ==="
strings foto-produk.png | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

# 5. Strings minimal length
echo ""
echo "=== Strings (min 20 chars) ==="
strings -n 20 foto-produk.png

# Buat gambar dengan metadata palsu
python3 -c "
import struct, zlib, time

# PNG with multiple text chunks
sig = b'\\x89PNG\\r\\n\\x1a\\n'

# IHDR
ihdr_data = struct.pack('>IIBBBBB', 100, 100, 8, 2, 0, 0, 0)
ihdr_crc = zlib.crc32(b'IHDR' + ihdr_data) & 0xffffffff
ihdr = struct.pack('>I', 13) + b'IHDR' + ihdr_data + struct.pack('>I', ihdr_crc)

# tEXt chunks (metadata)
def make_text(key, value):
    data = key.encode() + b'\\x00' + value.encode()
    crc = zlib.crc32(b'tEXt' + data) & 0xffffffff
    return struct.pack('>I', len(data)) + b'tEXt' + data + struct.pack('>I', crc)

text_chunks = b''
text_chunks += make_text('Author', 'Hacker1337')
text_chunks += make_text('Software', 'Microsoft Paint')
text_chunks += make_text('Description', 'Foto KTP nasabah - rahasia')
text_chunks += make_text('Copyright', 'Data dicuri dari bank X, 2024')

# IDAT
raw = b'\\x00' + b'\\x00\\x00\\x00' * 10000  # 100x100 pixels
compressed = zlib.compress(raw)
idat_crc = zlib.crc32(b'IDAT' + compressed) & 0xffffffff
idat = struct.pack('>I', len(compressed)) + b'IDAT' + compressed + struct.pack('>I', idat_crc)

# IEND
iend_crc = zlib.crc32(b'IEND') & 0xffffffff
iend = struct.pack('>I', 0) + b'IEND' + struct.pack('>I', iend_crc)

with open('foto-ktp.png', 'wb') as f:
    f.write(sig + ihdr + text_chunks + idat + iend)

print('✅ foto-ktp.png with EXIF-like metadata created')
"

# Analisis metadata
echo "=== EXIF / Metadata Analysis ==="
exiftool foto-ktp.png

# Filter metadata spesifik
echo ""
echo "=== Author & Software ==="
exiftool foto-ktp.png | grep -E "(Author|Software|Description|Copyright|Creator)"

# Buat file yang mengandung file lain di dalamnya
python3 -c "
import struct, zlib

# Buat file ZIP yang embedded di dalam PNG
# 1. Buat PNG dulu
sig = b'\\x89PNG\\r\\n\\x1a\\n'

# IHDR (small 1x1)
ihdr_data = struct.pack('>IIBBBBB', 1, 1, 8, 2, 0, 0, 0)
ihdr_crc = zlib.crc32(b'IHDR' + ihdr_data) & 0xffffffff
ihdr = struct.pack('>I', 13) + b'IHDR' + ihdr_data + struct.pack('>I', ihdr_crc)

# Minimal IDAT
raw_data = b'\\x00' + b'\\x00\\x00\\x00'
compressed = zlib.compress(raw_data)
idat_crc = zlib.crc32(b'IDAT' + compressed) & 0xffffffff
idat = struct.pack('>I', len(compressed)) + b'IDAT' + compressed + struct.pack('>I', idat_crc)

# IEND
iend_crc = zlib.crc32(b'IEND') & 0xffffffff
iend = struct.pack('>I', 0) + b'IEND' + struct.pack('>I', iend_crc)

png_part = sig + ihdr + idat + iend

# 2. Buat minimal ZIP (file kosong)
import io, zipfile

zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, 'w') as zf:
    zf.writestr('secret.txt', 'DATA CURIAN: no_kartu_kredit.txt')
zip_data = zip_buffer.getvalue()

with open('gambar-embedded.zip.png', 'wb') as f:
    f.write(png_part + zip_data)

print('✅ gambar-embedded.zip.png created (PNG + ZIP appended)')
print(f'   PNG size: {len(png_part)}, ZIP size: {len(zip_data)}')
"

# Analisis dengan binwalk
echo "=== Binwalk Analysis ==="
binwalk gambar-embedded.zip.png

# Ekstrak embedded file
echo ""
echo "=== Extract dengan binwalk ==="
binwalk -e gambar-embedded.zip.png 2>/dev/null || echo "Ekstraksi otomatis gagal, coba manual:"
mkdir -p extracted
cd extracted
# Manual extraction using unzip
cp ../gambar-embedded.zip.png embedded.zip
unzip -o embedded.zip 2>/dev/null && cat secret.txt 2>/dev/null
cd ..

# Analisis hex dari awal file
echo "=== Hex Dump (32 byte pertama) ==="
xxd -l 32 foto-produk.png

# Cari anomali di tengah file
echo ""
echo "=== Hex di offset 1000 ==="
xxd -s 1000 -l 64 foto-produk.png 2>/dev/null || echo "File terlalu kecil"

# Bandingkan dengan file asli (tanpa hidden data)
echo ""
echo "=== Perbandingan dengan file bersih ==="
python3 -c "
# Buat versi bersih (tanpa hidden data)
with open('foto-produk.png', 'rb') as f:
    data = f.read()
    
# Cari IEND marker
iend_pos = data.find(b'IEND')
if iend_pos > 0:
    clean_end = iend_pos + 12  # length(4) + 'IEND' + CRC(4)
    print(f'IEND ditemukan di offset {iend_pos}')
    print(f'Data setelah IEND: {len(data) - clean_end} bytes - ini hidden data!')
    print(f'Isi hidden: {(data[clean_end:]).decode(\"utf-8\", errors=\"replace\")}')
"

# Cara cepat deteksi hidden data
echo "=== Deteksi Hidden Data ==="
for f in *.png; do
    # Bandingkan ukuran dengan isi yang diharapkan
    echo -n "$f: "
    strings $f | grep -qiE "(password|secret|api_key|token|http)" && echo "⚠️ MENGANDUNG DATA SENSITIF!" || echo "Bersih (tidak terdeteksi)"
done

# Hapus semua metadata dari file
exiftool -all= -overwrite_original foto.jpg

# Scan hidden data di semua file PNG di folder
for f in *.png; do
    echo "=== $f ==="
    strings -n 15 "$f" | head -5
done