like1000 picoCTF 2019 Solution

Description

1. Step 1Write a loop to extract recursively

   Observation

   The description says the file was tarred 1000 times. Unpacking that by hand is not realistic, so the answer is a loop counting down from 1000 to 1.

   The archive is a tar within a tar within a tar, 1000 levels deep. Write a bash loop that repeatedly extracts the tar file until no more tar files exist.

   bash

   for i in $(seq 1000 -1 1); do tar xf $i.tar; done

   Copied!

   What didn't work first

   Tried: Run tar xzf 1000.tar to extract the outermost archive, assuming it is gzip-compressed because .tar files often are.

   The -z in tar xzf forces gzip decompression first. These nested archives are plain uncompressed tar, so tar reports a decompression error and exits without extracting anything. Plain tar xf works because it detects the format itself.

   Tried: Loop from 1 to 1000 in ascending order with 'for i in $(seq 1 1000); do tar xf $i.tar; done'.

   The outermost file is 1000.tar, which holds 999.tar, and so on down. Counting up tries 1.tar first, which does not exist yet, so the loop fails immediately. Counting down works because each extraction produces the next file before the loop needs it.

   Learn more

   The tar utility (tape archive) packages multiple files into a single file without compression. Each tar xf file.tar extracts the contents of the archive into the current directory. If the archive contains another .tar file, you need to extract that one too.

   The loop counts from 1000 down to 1 because the outermost archive is 1000.tar, which contains 999.tar, which contains 998.tar, and so on down to 1.tar.

2. Step 2Find the flag file

   Observation

   The loop finished and no tar files are left, so the innermost archive is open. Whatever it held should now be sitting in the working directory.

   After the loop completes, the innermost archive yields flag.png (an image, not a text file). Open it to read the flag.

   bash

   ls

   Copied!

   bash

   # the flag is in flag.png - open it in an image viewer

   Copied!

   Expected output

   flag.png

   Learn more

   Each archive also contains a filler file, and depending on the instance the next .tar may land in the current directory or inside a numbered subdirectory. A robust, depth-agnostic loop that handles either layout is a find-based one rather than while [ -f *.tar ] (which errors when the glob matches zero or multiple files):

   while f=$(find . -name '*.tar' | head -1); [ -n "$f" ]; do
     tar -xf "$f" -C "$(dirname "$f")"
     rm "$f"
   done
   # then locate the image:
   find . -name 'flag.png'

Flag

Repeatedly extract the nested tars (a find-based loop handles whatever subdirectory layout the instance uses) down to the innermost flag.png, then open the image to read the flag.