Rating:

After downloading the attachment, the 010 Editor found that it was a compressed package. After changing it to. zip, it can indeed be decompressed. After decompressing, there is also a rock. lock and a txt file, so it is speculated to be a cyclic decompression. Simply scan the directory first, rename the. lock file to. zip file, and then extract the. lock file from the extracted folder and place it in the original directory and delete the previously renamed rock. zip file, After repeating 491 times, an error will be reported and it will be found that there is a rock. zip file that is not a compressed package. You can use the 010 Editor to obtain the flag
```
import os
import shutil
import time

def scan_file():
for f in os.listdir(): #Since this is the current path, it is necessary to place this code file in the same folder as the file you want to process
if f.endswith('.rock'):
return f

def unzip_it(f,i):
folder_name = f.split('.')[0]+str(i)
target_path = os.path.join('.',folder_name)
os.makedirs(target_path)
shutil.unpack_archive(f,target_path)

def delete(f):
os.remove(f)

if name == '__main__':
i = 1
while True:
zip_file = scan_file()
# print(zip_file)
if zip_file:
os.rename(zip_file,'rock.zip')
unzip_it('rock.zip',i)
delete('rock.zip')
os.rename('E:\\test\\rock'+str(i)+'\\rock.rock','E:\\test\\rock.rock')
i += 1
```
![](https://fushuling.com/wp-content/uploads/2023/04/1-44.png)

Original writeup (https://fushuling.com/index.php/2023/04/17/texas-security-awareness-week-2023-wp/).