like1000 picoCTF 2019 Solution

Published: April 2, 2026

Description

This .tar file got tarred 1000 times. Untar it to find the flag.

Download the tar file into a working directory.

bash
mkdir like1000 && cd like1000
bash
wget <url>/1000.tar
  1. Step 1Write a loop to extract recursively
    The archive is a tar within a tar within a tar, 1000 levels deep. Write a bash loop that repeatedly extracts the tar file until no more tar files exist.
    bash
    for i in $(seq 1000 -1 1); do tar xf $i.tar; done
    Learn more

    The tar utility (tape archive) packages multiple files into a single file without compression. Each tar xf file.tar extracts the contents of the archive into the current directory. If the archive contains another .tar file, you need to extract that one too.

    The loop counts from 1000 down to 1 because the outermost archive is 1000.tar, which contains 999.tar, which contains 998.tar, and so on down to 1.tar.

  2. Step 2Find the flag file
    After the loop completes, list the directory contents. There will be a text file (like flag.txt) alongside the final extracted files.
    bash
    ls
    bash
    cat flag.txt
    Learn more

    Alternatively, a more robust loop that handles any tar depth: while [ -f *.tar ]; do tar xf *.tar; rm *.tar; done. This keeps extracting until no more tar files remain, regardless of the exact depth.

Flag

picoCTF{...}

Use a bash loop to extract the tar 1000 times (from 1000.tar down to 1.tar), then read the flag file.

Want more picoCTF 2019 writeups?

Useful tools for Forensics

Related reading

What to try next