*([Original write-up](https://security.meta.stackexchange.com/a/3084/95381) by [@rawsec](https://twitter.com/rawsec/))*

## UnbreakMyStart (forensics, 337)

We get a `.tar.xz` file. Or so it seems...

$ tar -xvf unbreak_my_start.tar.xz
tar: This does not look like a tar archive
xz: (stdin): File format not recognized
tar: Child returned status 1
tar: Error is not recoverable: exiting now

Thanks, `tar`, so helpful. Let's look inside:

$ xxd unbreak_my_start.tar.xz
00000000: 504b 0304 1400 0800 0800 04e6 d6b4 4602 PK............F.
00000010: 0021 0116 0000 0074 2fe5 a3e0 07ff 007d .!.....t/......}
00000020: 5d00 331b 0847 5472 2320 a8d7 45d4 9ae8 ].3..GTr# ..E...
00000030: 3a57 139f 493f c634 8905 8c4f 0bc6 3b67 :W..I?.4...O..;g
00000040: 7028 1a35 f195 abb0 2e26 666d 8c92 da43 p(.5.....&fm...C
00000050: 11e1 10ac 4496 e2ed 36cf 9c99 afe6 5a8e ....D...6.....Z.
00000060: 311e cb99 f4be 6dca 943c 4410 8873 428a 1.....m..<D..sB.
00000070: 7c17 f47a d17d 7808 b7e4 22b8 ec19 9275 |..z.}x..."....u
00000080: 5073 0c34 5f9e 14ac 1986 d378 7b79 9f87 Ps.4_......x{y..
00000090: 0623 7369 4372 19da 6e33 0217 7f8d 0000 .#siCr..n3......
000000a0: 0000 001c 0f1d febd b436 8c00 0199 0180 .........6......
000000b0: 1000 00ad af23 35b1 c467 fb02 0000 0000 .....#5..g......
000000c0: 0459 5a .YZ

Starting with `PK\x03\x04` - that's a ZIP header!

**Pro tip:** Be smarter than me and don't try to brute-force the ZIP file entry offsets for ages. Cause, see that footer? `0x59 0x5A` is actually the `.xz` format's stream footer magic bytes. So it appears to be a valid XZ file, just with a ZIP header.

Now since, we don't have the time and energy to read specs, let's just make our own dummy `.xz`, use its header to replace the ZIP header and hope for the best:

$ tar -cfJ foo.tar.xz -T /dev/null
$ head -c 6 foo.tar.xz > patched.tar.xz
$ tail -c +10 unbreak_my_start.tar.xz >> patched.tar.xz
$ tar -xvf patched.tar.xz
flag.txt

$ cat flag.txt
hackover18{U_f0und_th3_B3st_V3rs10n}