Polyglot Files & Zip Appending

What is a Polyglot File?

A polyglot file is a binary payload crafted to be simultaneously valid according to two or more file format specifications.

For example, a GIF-ZIP file opens cleanly as an animated GIF image when viewed in a web browser, but unzips into a secret archive when extracted with unzip or 7z.

---

1. Appended ZIP Files (Overlay Data)

Many file formats (like JPEG, PNG, GIF) read headers starting at byte 0 and stop parsing when reaching an End-Of-File (EOF) marker.

Other formats (like ZIP) locate their End of Central Directory (EOCD) record by scanning backward from the end of the file.

+--------------------------+--------------------------+
|  JPEG Image Data & EOI   |  ZIP Archive Data & EOCD |
+--------------------------+--------------------------+
  ^ Parser 1 reads from top   ^ Parser 2 scans from bottom

Creating a Simple PNG-ZIP Concatenation

# Combine PNG image and ZIP archive into a single file
cat image.png secret.zip > polyglot.png

# View file as image
xdg-open polyglot.png

# Unzip hidden payload
unzip polyglot.png

---

2. Analyzing Polyglots with binwalk

binwalk scans binary files for embedded file magic signatures:

# Scan file for known signatures
binwalk polyglot.png

# Output:
# DECIMAL       HEXADECIMAL     DESCRIPTION
# 0             0x0             PNG image data, 800 x 600
# 45210         0xB09A          Zip archive data, at least 120 bytes

Extracting Embedded Containers

binwalk -e polyglot.png

---

3. PDF-ZIP Polyglots (Corkami Techniques)

PDF comments (% comment) permit arbitrary binary data before or after PDF structures. By placing a ZIP archive inside a PDF comment block, both PDF viewers and ZIP extractors treat the file as natively valid.

Use Mitra to generate dual-extension polyglots automatically:

python3 mitra.py file1.jpg file2.zip