Nineveh
在 Nineveh 靶機中找到一張圖片：
用類似 binwalk 之類的工具，就可以掃出除了圖片檔以外的其它空間：
$ binwalk nineveh.png
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 PNG image, 1497 x 746, 8-bit/color RGB, non-interlaced
84 0x54 Zlib compressed data, best compression
2881744 0x2BF8D0 POSIX tar archive (GNU)
同樣使用 binwalk 即可提取出藏在裡面的 .tar 檔案：
$ binwalk -e nineveh.png
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
84 0x54 Zlib compressed data, best compression
2881744 0x2BF8D0 POSIX tar archive (GNU)
WARNING: One or more files failed to extract: either no utility was found or it's unimplemented
$ find _nineveh.png.extracted/secret/
_nineveh.png.extracted/secret/
_nineveh.png.extracted/secret/nineveh.priv
_nineveh.png.extracted/secret/nineveh.pub
$ cat nineveh.priv
-----BEGIN RSA PRIVATE KEY-----
MIIE...<REDACTED>...O+EUG
-----END RSA PRIVATE KEY-----
研究一下發現這東西叫做 Polyglot File：
For the purpose of establishing a formal taxonomy for polyglot files, we refer to polyglots as having an overt format and a covert format. The overt format is the format the file presents as (e.g., matches the extension) while the covert format is not apparent without analysis. In most cases, a polyglot consists of a malicious file combined with a benign one; however, in some cases we found that both file formats play a role in advancing the malicious attack chain, as in the HTA+CHM polyglot utilized by IcedID in Section 3.2.1.
裡面也講了 Polyglot File 的四種種類，我們這個例子就是 Stack：
- Stack: File B is appended to the end of file A
- Parasite: File B is placed inside comment markers of file A
- Zipper: Both files are placed within one another’s comment markers
- Cavity: File B is placed inside a padding area of file A
這篇論文主要是在研究偵測 Polyglot File 的方法，但裡面也提到很多惡意 Polyglot File 的例子和許多基本的統計資料，有興趣可以看看。
至於實作方面這篇文章給了許多詳盡的工具，包括 Mitra、ExifTool 和 MIME sniffing 相關知識，蠻酷的。