Blog section
PicoCTF

PicoCTF like1000 Writeup: Automating Repeated tar Extraction

A picoCTF like1000 walkthrough using a simple Bash loop to extract nested tar archives until the flag appears.

Mar 8, 20243 min readAdapted from my picoCTF notes
PicoCTFForensicsBashtar

like1000 is a picoCTF 2019 forensics challenge where the provided archive has been tarred repeatedly. Manual extraction would be tedious, so automation is the right approach.

Initial archive

Extraction Loop

The archive names count down, so a Bash loop can extract each layer:

for ((i=1000; i>=1; i--))
do
    echo "Extracting ${i}.tar..."
    tar -xvf "${i}.tar"
done

Extraction output

Flag

After the repeated extraction finishes, the flag is available as an image.

open flag.png

Flag image

Key Takeaways

  1. Repetitive archive tasks should be scripted.
  2. The naming pattern tells you how to control the loop.
  3. Small Bash loops are often enough for CTF automation.