Jacob MacdonnellSecurity Operations & Network Analysis
LinkedIn
CTF Labs / Forensics

picoCTF: Big Zip Challenge

Technical write-up
On this page
  1. Challenge Overview
  2. Step-by-Step Solution
  3. Step 1: Download the Zip File
  4. Step 2: Extract the Zip File
  5. Step 3: Search for the Flag Inside the Extracted Files and Directories
  6. Step 4: Retrieve the Flag
  7. Summary of Commands
  8. Conclusion

Challenge Overview

The BigZip challenge involves extracting the flag hidden within a zip file. The zip file contains numerous files and directories, and the goal is to find the flag, which is in the format picoCTF{}, hidden within its contents.

Step-by-Step Solution

Step 1: Download the Zip File

The first step is to download the zip file containing the hidden flag.

analyst@lab-host:~ $ wget https://artifacts.picoctf.net/c/503/big-zip-files.zip

wget is a tool to download files from the internet. We use it here to download the zip file from the provided URL.

Step 2: Extract the Zip File

Next, we extract the contents of the zip file to inspect the files inside.

analyst@lab-host:~ $ unzip big-zip-files.zip

unzip is the command used to extract the contents of a .zip file. After running this, you’ll have a new folder (big-zip-files) containing all the extracted files and folders.

Step 3: Search for the Flag Inside the Extracted Files and Directories

The key step is to search through all the files inside the extracted folder for the flag. Since the zip file may contain many subdirectories, we use the grep command to search recursively through all files.

analyst@lab-host:~ $ grep -r 'picoCTF{' ./big-zip-files/

Explanation of the Command:

  • grep: A command-line tool used for searching specific text or patterns inside files.
  • -r (recursive): The -r flag tells grep to search recursively inside all files and subdirectories of the big-zip-files folder. Without this flag, grep would only search in files located directly in the specified folder, not in any subdirectories.
  • ‘picoCTF{’: This is the search pattern, which is the start of the flag format. We’re looking for any text that starts with picoCTF{, which is the typical format of the flags in picoCTF challenges.
  • ./big-zip-files/: This is the directory where the zip file was extracted. By specifying this folder, we ensure that the search covers all the files and subfolders inside the big-zip-files directory.
  • Result: If the flag exists within any file inside the extracted contents, grep will display the matching line.

Step 4: Retrieve the Flag

After running the grep command, the matching flag is displayed in the terminal. The exact challenge flag is intentionally omitted from this public write-up; the useful evidence is the recursive-search method and the successful recovery.

Summary of Commands

  1. Download the Zip File:
analyst@lab-host:~ $ wget https://artifacts.picoctf.net/c/503/big-zip-files.zip
  1. Extract the Zip File:
analyst@lab-host:~ $ unzip big-zip-files.zip
  1. Search for the Flag:
analyst@lab-host:~ $ grep -r 'picoCTF{' ./big-zip-files/
  1. Retrieve the Flag: The output of the above command confirms the flag value; the value itself is redacted from the portfolio.

Conclusion

By following the above steps, we successfully extracted and searched through the zip file and retrieved the flag hidden within. The use of the grep -r command allowed us to recursively search all files and directories inside the extracted folder, ensuring that we didn’t miss the flag even if it was buried in subdirectories.

This challenge demonstrates the importance of knowing how to efficiently search through large collections of files, a common task in cybersecurity investigations and CTF competitions.