Big Zip picoGym Exclusive Solution

Description

1. Step 1Fan out with grep

   Observation

   The archive holds thousands of files across nested directories, so opening them by hand is hopeless. The flag always starts with the same literal prefix, and one recursive content search finds it.

   Recursively search for the picoCTF prefix; the archive is too large to inspect manually, but grep cuts straight to the hits.

   bash

   grep -R pico

   Copied!

   Expected output

   big-zip-files/files/s/e/archiver/s2/d3/3/z7/c/e9/b/archiver.txt:./files/s2/d3/3/z7/c/e9/b/archiver.txt:picoCTF{gr3p_15_m4g1c_ef87...}

   Pipe the results into other text utilities if you want to isolate the final colon-separated field on each line.

   What didn't work first

   Tried: Run 'grep pico' without the -R flag, pointing it at the top-level directory name.

   Without the recursive flag, grep treats its argument as one file and either reports that it is a directory or returns nothing, depending on the version. That flag is what makes it walk every subdirectory.

   Tried: Use 'find . -name "*flag*"' to locate the file by name instead of by content.

   The archive gives everything a generic name, with no reference to a flag anywhere in the paths, so a filename search finds nothing. The string is inside a file, not in its name.

   Learn more

   grep (Global Regular Expression Print) is a Unix command-line tool that searches file contents for lines matching a pattern. The -R flag makes it recurse through every file in a directory tree, which is the key capability here - instead of opening thousands of files by hand, a single command scans all of them simultaneously.

   When dealing with archives containing a very large number of files, manual inspection is impractical. Recursive grep is the standard approach: it reads every file in the tree and prints only the lines (and filenames) that match. The pattern pico is intentionally broad - it catches the picoCTF{ prefix no matter which subdirectory or filename the flag is hiding in.

   This skill applies directly to real-world security investigations: incident responders use recursive search tools to find indicators of compromise (malicious strings, backdoor signatures, hardcoded credentials) across thousands of files on a compromised system. Learning to combine grep with other tools in a pipeline is one of the most transferable skills in the field.

2. Step 2Trim the noise

   Observation

   The raw output mixes the flag in with full paths and surrounding text, awkward to read and worse to script against. Pipe it through a regex and keep only the token.

   Every hit prints a full path plus surrounding text. Use additional tools to strip away the file path and metadata so the raw flag remains.

   bash

   grep -R pico | grep -oE 'picoCTF\{.*\}' --color=none

   Copied!

   bash

   grep -R pico | sed 's/.*://'

   Copied!

   Expected output

   picoCTF{gr3p_15_m4g1c_ef87...}

   What didn't work first

   Tried: Use 'grep -R pico -l' to get just the filename, then cat that file and visually locate the flag.

   Listing filenames narrows it to one file, and you still have to open that file and pick the flag out of the surrounding text. Extracting with a regex gets the token in one step.

   Tried: Try 'grep -R pico | awk "{print $NF}"' to grab the last whitespace-delimited field.

   grep separates its fields with colons, not whitespace, and the matching line has no spaces in it, so awk's default splitter treats the whole line as one field and $NF prints it unchanged. Set the delimiter explicitly (awk -F: '{print $NF}') or use the sed substitution below, which cuts at the last colon.

   Learn more

   When grep finds a match inside a file, it outputs the filename followed by a colon and the entire matching line. In a large archive the noise can make the actual flag hard to read. The -o flag tells grep to print only the matching portion of each line, and -E enables extended regex so you can write patterns like picoCTF\{.*\} to isolate precisely the token you need.

   sed (Stream EDitor) is a Unix tool for transforming text. The substitution s/.*:// replaces everything up to and including the last colon on each line with nothing, and colon is exactly the separator grep puts between the filename and the matching line, so what survives is the flag. Both approaches demonstrate the Unix philosophy: each tool does one thing, and they compose naturally through pipes.

   Regex fluency is essential for text extraction in CTF challenges and professional security work alike. Patterns like picoCTF\{.*\} are simple examples of the same greedy extraction patterns used to pull sensitive data (tokens, passwords, API keys) from log files, memory dumps, and network captures during real investigations.

3. Step 3Record the flag

   Observation

   The extracted token is already in standard flag format, with nothing encoded on top, so copy it as-is.

   Once only the picoCTF token remains, copy it out and you are done; no further decoding is necessary.

   Learn more

   In many CTF challenges the flag is encoded, encrypted, or otherwise transformed. In this case, however, the flag is stored as plain text inside one of the archive's files - the only challenge is locating it among thousands of candidates. The fact that no decoding is required is itself an important lesson: always determine first whether data is encoded before spending time trying to reverse a transformation that was never applied.

   The broader skill being reinforced here is efficient file-system search. In professional contexts - malware triage, log analysis, code review - the ability to quickly locate a specific string across a large corpus separates experienced practitioners from novices. Tools like grep, ripgrep (rg), and ack are all worth adding to your toolkit, each with different performance and feature tradeoffs.

Flag

Any recursive grep that isolates the final token reveals the exact flag as stored inside the archive.