Skip to main content
picoCTF Solutions
picoCTF 2026General SkillsEasy

Piece by Piece picoCTF 2026 Solution

SSH into a remote machine, locate fragmented archive files, and reassemble them to uncover the flag.

Published: March 20, 2026Updated: September 20, 2026

Description

After logging in, you will find multiple file parts in your home directory. These parts need to be combined and extracted to reveal the flag.

Setup

Launch the challenge instance and SSH in.
List files in the home directory to see the split archive parts.
bash
ls -la
bash
file *

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
  1. Step 1SSH in and list the file parts
    Observation
    The description says multiple file parts sit in the home directory. SSH in, list them, and run file over them to count the parts and learn the real format from the magic bytes.
    Log into the challenge instance via SSH. Your home directory contains multiple numbered split-archive parts (e.g. file.zip.001, file.zip.002, ... or file.aa, file.ab, ...).
    bash
    ssh ctf-player@<HOST> -p <PORT_FROM_INSTANCE>
    bash
    ls -la
    bash
    file *
    What didn't work first

    Tried: Run 'file *' and trust the filename extension instead of the magic byte output.

    Extensions are cosmetic and the author can rename anything. file reads the magic bytes, so a name of data.bin means nothing if file reports a ZIP archive. Trust the name and reach for the wrong extractor, and you get a format error instead.

    Tried: Use 'ls' without '-v' or '-la' and assume the default listing order is the correct reassembly order.

    Plain ls sorts alphabetically, which breaks numeric order when the parts are not zero-padded: part10 lands between part1 and part2. The -v flag sorts naturally. Concatenate out of order and the archive structure is corrupt, so extraction fails or reports a missing central directory.

    Learn more

    Split archives are a technique for dividing large files into smaller chunks for transfer over media with size limits, email attachments, or slow connections. The original file is split into numbered parts that must be reassembled in order before extraction. Common formats include .zip.001/.zip.002 (WinZip split), .part1.rar/.part2.rar (WinRAR split), or alphabetical suffixes from the Unix split command (file.aa, file.ab, ...).

    The file command reads a file's magic bytes (the first few bytes of the file) to determine its true type regardless of its extension. This is essential in CTF challenges where files may have misleading names or no extension. For example, a file named data.bin might actually be a ZIP archive (magic bytes PK\x03\x04), a gzip stream (magic bytes \x1f\x8b), or a PNG image (\x89PNG).

    Understanding file magic bytes is a foundational forensics skill. Tools like file, xxd, and binwalk all use magic byte databases to identify file types, and this knowledge lets you choose the correct extraction tool even when extensions are wrong or missing.

  2. Step 2Combine all parts
    Observation
    The parts carry numbered or lettered suffixes, so concatenate them in strict order with a naturally sorted glob and you get one valid archive.
    Concatenate the parts in deterministic sort order. Always verify the glob expansion before piping into cat - a wrong order produces a corrupt archive that fails to extract.
    bash
    # Always check what the glob expands to first:
    bash
    ls -v *part* *.zip.* *.a? 2>/dev/null
    bash
    # Numbered .zip parts:
    bash
    cat *.zip.* > /tmp/combined.zip
    bash
    # Letter-suffixed (split default):
    bash
    cat *.a? > /tmp/combined.zip
    bash
    # RAR-style multi-part - tighten the glob to exclude unrelated files:
    bash
    cat *part*.rar > /tmp/combined.rar
    bash
    # When you really need natural sort (e.g. part1, part2, ..., part10):
    bash
    cat $(ls -v *part*) > /tmp/combined
    bash
    file /tmp/combined*
    What didn't work first

    Tried: Use 'cat *.zip' instead of 'cat *.zip.*' to concatenate the parts.

    A glob ending in .zip matches only the final combined file, not parts named file.zip.001. Those need a trailing dot and suffix in the pattern. The wrong glob either matches nothing or scoops up an already-combined file, leaving a doubled or empty archive.

    Tried: Use 'zip -FF combined.zip --out fixed.zip' to repair the archive instead of reassembling from parts.

    zip -FF repairs one corrupt archive; it does not reassemble split parts. Point it at the first part and it announces a fix and then errors out, because the central directory it needs lives in the last part, which was never concatenated.

    Learn more

    The Unix cat command (concatenate) is the correct tool for reassembling split binary files. Since binary archives have their own internal structure with an end-of-archive marker, simply concatenating the parts in sorted order produces a valid archive that extraction tools can parse. Shell glob expansion (*.zip.*) sorts alphabetically/numerically by default, which is the correct order for numbered parts.

    Sort order matters critically. If parts are concatenated out of order, the resulting file will be corrupt and unextractable. For parts with numeric suffixes, ensure the sort is numeric: 001, 002, 003, ..., 009, 010 rather than 001, 010, 002 (lexicographic order). The glob *.zip.* sorts correctly because the numeric suffix is zero-padded.

    For more complex reassembly scenarios, tools like cat $(ls -v *.part) (using ls -v for natural sort), or explicit cat part1 part2 part3 > combined, give you full control over the concatenation order.

  3. Step 3Extract the archive with the password
    Observation
    The combined file is a password-protected ZIP, and the instructions file gives the password. Pass it to unzip.
    The combined file is a password-protected ZIP. The instructions file says the password is 'supersecret'. Use unzip with that password.
    bash
    unzip -P supersecret /tmp/combined.zip -d /tmp/out

    Expected output

    Archive:  /tmp/combined.zip
  inflating: /tmp/out/flag.txt
    What didn't work first

    Tried: Try 'unzip combined.zip' without the -P flag and enter the password interactively when prompted.

    Interactive password entry works locally and can hang or fail silently in an SSH session without a TTY. And if the concatenation order was wrong, no prompt appears at all: unzip errors out before asking. Passing the password on the command line makes it scriptable and separates a wrong password from a corrupt archive by exit code.

    Tried: Try 7z x combined.zip without specifying the password, hoping 7z will auto-detect or prompt.

    7z does prompt for a password, but it detects ZipCrypto differently from unzip and can report a wrong password on an AES-encrypted archive even when the password is right. And cracking a ZipCrypto archive with a known plaintext is beside the point when the instructions file already gives you the password.

    Learn more

    Common archive formats and their extraction commands: unzip for ZIP files, tar xf for tar archives (which auto-detects gz/bz2/xz compression), 7z x for 7-Zip archives, unrar x for RAR files, and gunzip/bunzip2/unxz for single-stream compressed files.

    Password-protected archives are common in CTF challenges. Standard passwords to try include picoCTF, password, flag, the challenge name, and variations. If those fail, tools like john with zip2john/rar2john or hashcat can crack the password. ZIP encryption (ZipCrypto) is particularly weak and can be cracked even without a password if you know the contents of one file in the archive (known-plaintext attack).

    For layered archives (a tar inside a zip inside a gz), you may need to run multiple extraction steps. binwalk -e can automatically extract nested archives - it scans for file signatures within files and extracts everything it finds.

  4. Step 4Read the flag
    Observation
    Extraction drops files in /tmp/out, and the flag may sit inside one with an unhelpful name. Run strings over everything and grep for the flag pattern.
    Catalogue everything that came out before grepping. The flag may be in the filename, in binary data, or in a file that doesn't have a .txt extension.
    bash
    ls /tmp/out
    bash
    # First triage what you got - types and any hints in filenames:
    bash
    file /tmp/out/*
    bash
    ls /tmp/out | grep -iE 'flag|pico'
    bash
    # Search across both text and binary:
    bash
    strings /tmp/out/* 2>/dev/null | grep -E 'picoCTF\{[^}]+\}'
    bash
    # As a fallback, the bare grep across all extracted files:
    bash
    grep -roa 'picoCTF{[^}]*}' /tmp/out/ 2>/dev/null
    Learn more

    After extraction, the flag is typically in a file named flag.txt, flag, or a similarly obvious name, but not always. Run file * over the extracted set first - a binary or an image among the outputs is a strong hint that the flag is embedded somewhere non-obvious. strings * | grep picoCTF handles binary data; if even that fails, walk the files with xxd and look for fragmented or encoded flags.

    CTF flags sometimes appear in unexpected places: as the filename itself, embedded in an image (check with strings), inside binary data (check with xxd | grep -a pico), or hidden behind one more decoding step (base64, hex, ROT13). For more on hex-level inspection see Hex dumps for CTF; for the general shell toolkit used here see Linux CLI for CTF.

    This challenge teaches a workflow that appears frequently in forensics and incident response: receiving a collection of file fragments, reassembling them, extracting the archive, and searching the contents. The same sequence is used to recover data from split disk dumps, fragmented network transfers, and distributed backups.

Interactive tools
  • Regex TesterTest regular expressions against a string with live match highlighting, flag toggles, and common CTF pattern shortcuts.
  • Strings ExtractorPull printable text from any binary, library, or image. ASCII and UTF-16 detection, configurable minimum length, flag-like highlight, no command line needed.
  • File Magic IdentifierIdentify file types from magic numbers. Paste hex bytes or drop a file to detect PNG, JPEG, ZIP, PDF, ELF, PCAP, SQLite, and dozens of other formats.

Flag

Reveal flag

picoCTF{z1p_and_spl1t_f1l3s_4r3_fun_...}

SSH into the server, read the instructions file for the password ('supersecret'), combine the split parts with cat, and unzip with -P supersecret.

Key takeaway

Reassembling a split archive is basic file recovery: parts produced by split, or by a zip splitter, only become a valid archive again in strict order. file identifies types by magic bytes rather than extensions, which matters whenever names are stripped or misleading. The same workflow recovers fragmented disk images, carves files out of raw network captures, and rebuilds data spread across backup segments.

Related reading

Useful tools for General Skills

Where to go next

Try these next