WeChall - eXtract Me

Posted on In Views: Disqus:

Challenge

eXtract Me (Encoding, Stegano) — score 3, by oleg.

Yo dog, I heard you like zips so we put a zip in your zip so you can unzip unzipped zips. Enjoy!

Download: r.zip (2698 bytes).

Solution

The challenge is an archive matryoshka: the r.zip contains an infinite recursive zip (r/r.zip → always the same inner zip), plus hidden data appended after the ZIP EOCD.

Step 1 — Cut out the second archive

r.zip is actually two things stitched together:

  • First 440 bytes: the recursive zip (r/r.zip, endless loop)
  • Remaining 2258 bytes: LZW-compressed data (magic \x1f\x9d)

Extract the trailing data and decompress with uncompress:

1
2
3
4
5
6
7
8
$ python3 -c "
with open('r.zip','rb') as f:
    d=f.read()
open('trailing.Z','wb').write(d[440:])
"
$ uncompress -c trailing.Z > stage1.xar
$ file stage1.xar
stage1.xar: xar archive compressed TOC

Step 2 — Extract the chain

The XAR contains file "8", which is itself LZW-compressed:

1
2
$ xar -xf stage1.xar       # extract → file "8"
$ uncompress -c 8 > stage2.rar

Then continue extracting each layer with 7z or the appropriate tool:

Layer Format Tool Contains
r.zip tail LZW (.Z) uncompress XAR archive
XAR xar xar / Python file "8" (LZW)
file 8 LZW (.Z) uncompress RAR archive
RAR rar 7z file "A" (XZ)
XZ xz 7z file "A~" (ZOO)
ZOO zoo unar file "4" (RZIP)
RZIP rzip → ZZ0 → gzip → ARJ uncompress + 7z file "1" (ARJ → "3")
ARJ arj 7z file "3" (LZW)
file 3 LZW (.Z) uncompress 7z archive
7z 7z 7z file "F" (bzip2)
bzip2 bz2 bunzip2 L0LYouThInkiTSh0uldB3SoEasY?

The full extraction chain is:

1
2
3
4
5
6
r.zip
 ├─ r/r.zip (infinite recursion, ignore)
 └─ trailing LZW data
    └─ XAR → 8(LZW) → RAR → A(XZ) → A~(ZOO) → 4(RZIP)
       └─ ZZ0(gzip) → 1(ARJ) → 3(LZW) → 7z → F(bzip2)
          └─ "L0LYouThInkiTSh0uldB3SoEasY?" (password)

This showcases the depth of archive format history — ZIP, LZW compress, XAR, RAR, XZ, ZOO, RZIP, GZip, ARJ, 7z, bzip2 — almost every compression format ever invented.