This is my solution to the NACTF2020 Challenge “Zip Madness”.
Evan is playing Among Us and just saw an imposter vent in front of him! Help him get to the emergency button by following the directions at each level.
The challenge also requires download of a zip file from the challenge page (which I cannot host here).
The challenge is solved with the following Python code, which extracts all nested zip files into a single folder. It’s then a simple task to dig out the flag.txt file from the extract_path folder:
from zipfile import ZipFile def unpack_zip(zipfile='', path_from_local=''): filepath = path_from_local+zipfile extract_path = "C:\\NACTF\\flag\\" parent_archive = ZipFile(filepath) parent_archive.extractall(extract_path) namelist = parent_archive.namelist() parent_archive.close() for name in namelist: try: if name[-4:] == '.zip': unpack_zip(zipfile=name, path_from_local=extract_path) except: print('failed on', name) pass return extract_path unpack_zip("C:\\NACTF\\flag.zip") flag = open("C:\\NACTF\\flag\\flag.txt", "r") print(flag.read())
This spits out the flag:
Credit where credit is due: I found the nested zip extraction code on GitHub, then edited the extract_path variable so that everything got dumped into the same folder. Worth mentioning that with significantly more nests, this might possibly be similar to a “ZipBomb” piece of malware, so above code should only be run on trusted files – or a hard limit added to number of recursions.