Forensics – like1000

like1000 - 250 pt

Challenge

This .tar file got tarred alot.

Hints

Try and script this, it'll save you alot of time

Solution

Opening 1000.tar we can see that it has 999.tar and inside 999.tar there's 998.tar and so on. So we can write a python script that uses the os module to do system commands.

import os
tar=1000
while os.path.exists("./1.tar")==False:
    cmd="tar -xvf "+str(tar)+".tar"
    os.system(cmd)
    os.system('rm ./'+str(tar+1)+'.tar')
    tar-=1

The script iterates and extracts the current archive (starting from 1000). After each archive is extracted it gets deleted to save memory.
When it's finished we can see that in 1.tar we have a png file with the flag inside.

picoCTF{l0t5_0f_TAR5}

Lascia un commento

Il tuo indirizzo email non sarà pubblicato. I campi obbligatori sono contrassegnati *