The image in this tweet displays its own MD5 hash.
You can download and hash it yourself, and it should still match - 1337e2ef42b9bee8de06a4d223a51337
I think this is the first PNG/MD5 hashquine.
holy FUCK.
Windows Snipping Tool is vulnerable to Acropalypse too.
An entirely unrelated codebase.
The same exploit script works with minor changes (the pixel format is RGBA not RGB)
Tested myself on Windows 11
Assuming this all works out, the image in this tweet is also a valid ZIP archive, containing a multipart RAR archive, containing the complete works of Shakespeare.
This technique also survives twitter's thumbnailer :P
I found a way to stuff up to ~3MB of data inside a PNG file on twitter. This is even better than my previous JPEG ICC technique, since the inserted data is contiguous.
The source code is available in the ZIP/PNG file attached:
How it works:
It's a PNG image with a clever palette. There's a checkerboard pattern, at 2x Twitter's default res. The "white" pixels are slightly tinted. When downscaled, the pixels average to grey-ish. There's no grey in the palette, so it picks the next closest match.