Zip, Zip, Hooray! — broncoctf2026

Description

"I was trying to compress my files and my script got a little carried away... Can you help me find my original file?"

Hint: the 7z files are password protected, and the password is the name of the first file inside.

Given a single challenge.zip downloaded from the CTFd instance. Goal: recover the original file (which holds the flag) from a runaway recursive compression chain.

Analysis

Despite the .zip extension, file challenge.zip reports gzip-compressed data (was "layer1.tar"), so the extension is misleading — this is a matryoshka-style nested archive.

The chain cycles the same compression pattern once per "round", repeating for hundreds of rounds:

gzip (.tar.gz) -> tar (.tar) -> bzip2 (.bz2) -> 7z (password-protected AES) -> zip -> (back to gzip)

Two gotchas per round:

• tar @PaxHeader: tar extraction emits an extra @PaxHeader pseudo-file that must be filtered so the "single next file" logic keeps working.
• 7z password: each 7z layer is AES-encrypted. Per the hint, the password for a 7z archive is the full basename (with extension) of its first contained member. E.g. the 7z named layer290 contains layer292.zip, so its password is layer292.zip.

7z handles gzip, bzip2, tar, zip and 7z transparently, so a single loop using 7z as a universal driver can walk every layer type.

Solution

Automate the traversal:

...