broncoCTF 2026 - Zip, Zip, Hooray!

Challenge Description

I was trying to compress my files and my script got a little carried away… Can you help me find my original file?

Hint: the 7z files are password protected, and the password is the name of the first file inside.

We get a single challenge.zip.

Initial Analysis

Despite the name, the magic bytes say otherwise:

$ file challenge.zip
challenge.zip: gzip compressed data, was "layer1.tar", ... original size ... 481280

It is a gzip of layer1.tar. Peeling a few layers by hand exposes a repeating cycle:

challenge.zip (gzip)  ->  layer1.tar        (tar)
layer1.tar            ->  layer2.bz2        (bzip2)
layer2.bz2            ->  layer2            (7-zip archive, password protected)
layer2 (7z)           ->  layer4.zip        (zip)
layer4.zip            ->  layer5.tar.gz     (gzip)
...

The “script that got carried away” wrapped the original file in a deep stack cycling through five formats:

zip  ->  gzip  ->  tar  ->  bzip2  ->  7z (encrypted)  ->  zip  ->  ...

The Vulnerability

Only the 7-zip stage is non-trivial, and it gives itself away. 7-zip encrypts file contents by default but leaves the filename table in cleartext — header encryption (-mhe=on) was not used here. So the archive can be listed without the password:

1
import py7zr
2
with py7zr.SevenZipFile("layer2", "r") as z:
3
    print(z.getnames())       # ['layer4.zip']
4
    print(z.needs_password()) # True

The archive holds exactly one file, layer4.zip — and per the hint, that filename is the password. Listing the archive hands you the very string needed to decrypt it:

1
with py7zr.SevenZipFile("layer2", "r", password="layer4.zip") as z:
2
    z.extractall("out")

Every 7z layer works the same way: read the first name, feed it back as the key.

Exploitation

Doing that a thousand times by hand is not happening. A recursive unpacker that detects each layer by magic byte, dispatches to the right decompressor, and for 7z reads the first filename to use as the password, peels the whole stack unattended:

1
#!/usr/bin/env python3
2
import os, sys, gzip, bz2, lzma, tarfile, zipfile, shutil
3
import py7zr
4

5
WORK = os.path.abspath("unpack")
6

7
def magic(path):
8
    with open(path, "rb") as f:
9
        h = f.read(16)
10
    if h[:2] == b"\x1f\x8b": return "gzip"
11
    if h[:3] == b"BZh": return "bzip2"
12
    if h[:6] == b"\xfd7zXZ\x00": return "xz"
13
    if h[:6] == b"7z\xbc\xaf\x27\x1c": return "7z"
14
    if h[:4] in (b"PK\x03\x04", b"PK\x05\x06"): return "zip"
15
    with open(path, "rb") as f:
16
        f.seek(257)
17
        if f.read(5) == b"ustar": return "tar"
18
    return "unknown"
19

20
def unpack(path, outdir):
21
    os.makedirs(outdir, exist_ok=True)
22
    kind = magic(path)
23
    base = os.path.basename(path)
24
    if kind in ("gzip", "bzip2", "xz"):
25
        opener = {"gzip": gzip.open, "bzip2": bz2.open, "xz": lzma.open}[kind]
26
        name = base
27
        for ext in (".gz", ".bz2", ".xz", ".tgz"):
28
            if name.endswith(ext): name = name[:-len(ext)]; break
29
        else:
30
            name += ".out"
31
        out = os.path.join(outdir, name)
32
        with opener(path, "rb") as fi, open(out, "wb") as fo:
33
            shutil.copyfileobj(fi, fo)
34
        return [out]
35
    if kind == "tar":
36
        with tarfile.open(path) as t:
37
            t.extractall(outdir)
38
            return [os.path.join(outdir, m.name) for m in t.getmembers() if m.isfile()]
39
    if kind == "zip":
40
        produced = []
41
        with zipfile.ZipFile(path) as z:
42
            for n in z.namelist():
43
                z.extract(n, outdir)
44
                p = os.path.join(outdir, n)
45
                if os.path.isfile(p): produced.append(p)
46
        return produced
47
    if kind == "7z":
48
        with py7zr.SevenZipFile(path, "r") as z:
49
            names = z.getnames()
50
        pw = names[0]                      # the hint: password == first filename
51
        with py7zr.SevenZipFile(path, "r", password=pw) as z:
52
            z.extractall(outdir)
53
        return [os.path.join(outdir, n) for n in names]
54
    return None
55

56
def main():
57
    start = sys.argv[1]
58
    if os.path.exists(WORK): shutil.rmtree(WORK)
59
    os.makedirs(WORK)
60
    seed = os.path.join(WORK, "layer_0")
61
    shutil.copy(start, seed)
62
    queue, finals = [(seed, 0)], []
63
    while queue:
64
        path, d = queue.pop(0)
65
        outdir = os.path.join(WORK, f"d{d}_{os.path.basename(path)}_out")
66
        produced = unpack(path, outdir)
67
        if produced is None:
68
            finals.append(path); continue
69
        for p in produced:
70
            queue.append((p, d + 1))
71
    print("FINAL:", *[os.path.relpath(f, WORK) for f in finals])
72

73
if __name__ == "__main__":
74
    main()

py7zr is the only non-stdlib dependency; gzip, bzip2, xz, tar and zip are all handled by the standard library.

Running it bottoms out after exactly 1000 layers:

$ python3 solve.py challenge.zip
...
[d1248] .../layer998         -> 7z
    [7z] password='layer1000.zip' OK
[d1249] .../layer1000.zip    -> zip
[d1250] .../flag.txt         -> unknown
FINAL: .../flag.txt

Flag

bronco{i_h4te_f1l3_c0mpr3ssi0n}