https://app.hackthebox.com/challenges/98

Description

Just unzip the archive … several times …

Exploitation

#!/usr/bin/python3
import re
import os
import sys
import zipfile
from PIL import Image
from tqdm import tqdm

def morse_decode(morse_list):
    password = ""
    MORSE_CODE_DICT = {'.-': 'a', '-...': 'b', '-.-.': 'c', '-..': 'd','.': 'e', '..-.': 'f', '--.': 'g', '....': 'h','..': 'i', '.---': 'j', '-.-': 'k', '.-..': 'l','--': 'm', '-.': 'n', '---': 'o', '.--.': 'p','--.-': 'q', '.-.': 'r', '...': 's', '-': 't','..-': 'u', '...-': 'v', '.--': 'w', '-..-': 'x','-.--': 'y', '--..': 'z', '-----': '0', '.----': '1','..---': '2', '...--': '3', '....-': '4', '.....': '5','-....': '6', '--...': '7', '---..': '8', '----.': '9','-..-.': '/', '.-.-.-': '.', '-.--.-': ')', '..--..': '?','-.--.': '(', '-....-': '-', '--..--': ','}
    for morse in morse_list:
        password += MORSE_CODE_DICT.get(morse)
    return password

def morse():
    fp = open('./pwd.png', 'rb')
    image = Image.open(fp)
    pixel = list(image.getdata())
    background = pixel[0]
    chars = []
    for i,v in enumerate(pixel):
        if v == background:
            chars.append(" ")
        else:
            chars.append("*")
    output = "".join(chars)
    output = re.sub(r'^\s*', '', output)
    output = re.sub(r'\s*$', '', output)
    output = re.sub(r'\*{3}', '-', output)
    output = re.sub(r'\*', '.', output)
    output = re.sub(r'\s{2,}', ' | ', output)
    output = re.sub(r'\s', '', output)
    output = output.split('|')
    fp.close()
    return output

def unzip_file(path, number, password):
    zip_path = "flag_" + str(1000-number) + ".zip"
    fp = zipfile.ZipFile(zip_path)
    for file in fp.namelist():
        fp.extract(file,"./",pwd=password.encode("utf-8"))
    fp.close()

def main():
    path = sys.path[0]
    for number in tqdm(range(1,1001), desc="Extracting archives"):
        morse_list = morse()
        password = morse_decode(morse_list)
        try:
            unzip_file(path, number, password)
            path = "./flag"
            os.chdir(path)
            try:
                fp = open('./flag', 'r')
                flag = fp.readlines()
                print(flag)
                fp.close()
                break
            except:
                continue
        except:
            continue

if __name__ == "__main__":
    main()

Summary

M0rsarchive: reduce the custom rules to a scriptable check and use the smallest reliable path to the flag.