Mar 19, 2021 12:42:00

'How to post a ZIP file by pretending to be an image' is discovered on Twitter

You can post images and movies to Twitter, but you cannot post them because they do not support file formats such as text files and ZIP files. Meanwhile, security researcher

David Buchanan has published a method for uploading a ZIP file to Twitter by disguising it as a PNG image.

I found a way to stuff up to ~ 3MB of data inside a PNG file on twitter. This is even better than my previous JPEG ICC technique, since the inserted data is contiguous.

The source code is available in the ZIP / PNG file attached: pic.twitter.com/zEOl2zJYRC
— DаvETERNUS d Вuc anyone а nаn (@ David3141593) March 17, 2021

The image attached to Mr. Buchanan's post is 'a ZIP file disguised as a PNG image'. Actually, using ' Twitter Image Downloader ' etc., I will try to download the image published by Mr. Buchanan in full size.

Rename the downloaded PNG format image file from '○○○ .png' to '○○○ .zip'.

Unzip the resulting ZIP file with decompression software such as 'Explzh'.

Then, it succeeded in decompressing wonderfully. The contents of the ZIP file was a file named 'tweetable-polyglot-png-main'.

The file contained a Python script 'pack.py' developed by Mr. Buchanan to generate a 'ZIP file disguised as a PNG image' and an instruction manual.

ZIP files are not the only file formats that can be uploaded using the method discovered this time. In fact, Buchanan also posted 'MP3 files disguised as PNG images'.

Download this one, rename to .mp3, and open in VLC for a surprise. (Note: make sure you download the full resolution version of the file, should be 2048x2048px) pic.twitter.com/x2J88xkBhd
— DаvETERNUS d Вuc anyone а nаn (@ David3141593) March 17, 2021