like1000.md

PicoCTF 2019 - like1000

Author: PinkNoize

Forensics - 250

This .tar file got tarred alot. Also available at /problems/like1000_0_369bbdba2af17750ddf10cc415672f1c.

Writeup

This challenge provides us with a tar file called 1000.tar. If we try extracting this we get 2 files, 999.tar and filler.txt. This suggests that there are many tar files within this tar file along with other junk files. We can write a script to extract all the nested tar files.

#!/bin/bash

# Make a directory to extract everything to
mkdir like1000
# Copy the first tar file to the directory
cp 1000.tar like1000/

# count the number of tar files in like1000
tar_exists=`ls -1 like1000/*.tar 2>/dev/null | wc -l`
while [  $tar_exists != 0 ]; do
    # For each tar file
    for f in like1000/*.tar; do
        # Extract the tar file
        tar xf "$f" --directory like1000
        # Delete the tar file 
        rm "$f"
    done
    # count the number of tar files in like1000
    tar_exists=`ls -1 like1000/*.tar 2>/dev/null | wc -l`
done

After running this script there should be a file called flag.png with the flag, picoCTF{l0t5_0f_TAR5}.