Writeup for CyLab/picoCTF challenge “Big Zip”

Learn how CyLab's "Big Zip" challenge introduces recursive grep, searching thousands of files across hundreds of directories to find a hidden flag.

This writeup gives a step-by-step explanation of the CyLab Security Academy challenge "Big Zip". The best learning experience comes from working through the challenge alone, but read on if you're stuck or are curious about other approaches.

CyLab Security Academy (previously called "picoCTF") uses Capture The Flag (CTF) security challenges to teach security fundamentals. The challenges cover various security categories (web exploitation, cryptography, forensics, etc) but they all have the common goal of finding a flag in the format picoCTF{unique-text-string-here}. Some challenges are easy and others deviously difficult, but they are all great for learning security skills.

About the "Big Zip" Challenge

This is a beginner challenge, and it can be solved by anyone with a few technical skills that will be explained in the writeup.

• Name: Big Zip
• Category: General Skills
• Difficulty: Easy
• Description: Unzip this archive and find the flag.
• Hint 1: Can grep be instructed to look at every file in a directory and its subdirectories?

This challenge description says that the provided file contains the flag, and will involve unzipping the file and using grep to find the flag. This seems like an introductory challenge and should be straightforward.

Background Knowledge

To solve this challenge it helps to understand:

• How the Linux terminal works, and the basics of navigating the file system. To learn more, please read the article "CTF Basics: Understanding the Linux Terminal"

If the above is a new concept, it's good to first get a solid understanding by reading the article. The walkthrough below covers this topic but it does not go into detail.

The solution for this challenge builds on the skills learned in the "First Grep" challenge, so it's recommended to complete that challenge before starting this one.

Solution Walkthrough

The solution to this challenge begins with the Download zip file link in the description. This file can be downloaded using the browser, but this solution uses the command line so the wget command is another way to download the file.

Since not everyone has a Linux computer at home, CyLab provides the WebShell, which is a browser-based terminal using the Ubuntu flavour of Linux. The WebShell is accessed through the Open in Workspace button at the bottom:

Once the Workspace is open, the Terminal tab accesses the Linux terminal (or "shell"):

The terminal / shell is an important lower-level tool for working with all computers, including Linux servers.

Downloading the Files

The wget command is used to retrieve this challenge's files. The link for the file is in the description for the challenge:

Browsers usually have a way to copy links, and in the Firefox browser this is done by right-clicking the link and choosing the Copy Link menu item. Once this is done, wget is used to download:

The bottom of the output shows that a file named big-zip-files.zip (3.04MB in size) has been downloaded and saved.

Finding the Flag

The first thing is to extract the contents of the downloaded file, which is done using the command unzip big-zip-files.zip:

Whoa, that produced so much output that it scrolled off the top of the screen. This isn't too surprising because the contents of the 3MB file is 350+ directories and nearly 9000 files. All of the unzipped files are in directories under the newly-created big-zip-files directory.

The author of this challenge gave the hint that grep should be used, and this makes sense as it would take forever to read through thousands of files. The grep command was introduced in "First Grep", but that challenge only involved searching a single file.

To read the manual for grep, the command is man grep and scrolling through the output eventually finds:

It looks like the -r option is what is needed. So to search all of the files in the big-zip-files directory for the substring picoCTF, the command is grep -r picoCTF big-zip-files:

There is the flag, although the contents are intentionally obscured. Publishing flags spoils the learning experience, as working through the steps is the best way to learn.

Learned in this Challenge

• The unzip command extracts the contents of a zip archive, and large archives can contain hundreds of directories and thousands of files
• The grep -r flag enables recursive search, telling grep to look through every file in a directory and all of its subdirectories
• The basic recursive grep syntax is grep -r pattern directory, which is essential when a flag could be in any one of many files
• Reading the man page for a familiar command like grep often reveals useful flags that weren't needed in earlier challenges

Beyond the Challenge

The focus of this challenge was using recursive grep to find a flag located in a large directory structure, but there are other approaches and directions worth exploring:

• grep -rl pattern directory prints only the filenames that contain a match, rather than the matching lines themselves, which is useful when there are many matches across many files
• grep -rn pattern directory adds line numbers to the output, making it easier to locate a match within a specific file
• The related "First Grep" challenge covers single-file grep and is the natural starting point before this one

Want to learn more about security weaknesses? I'm working through the CWE list and doing writeups for security challenges. Follow along for more articles like this one.