C, 407407 368 bytes
Thanks to Jonathan Frech for saving bytes.
golfed (file bracket.c):
#include<stdlib.h>
i,j,k,l,n;char*f(char*aa,int m)char*a;{for(i=0;a[i];++i){ifa[i]==91&&(a[i]=='['j=i+1)j=i+1;if;if(a[i]==']'a[i]==93){k=a[i+1]-48;if(k==0!k){for(l=i+2;l<m;++ll=i+2;l<m;)a[la[++l-i+j-3]=a[l];a=realloc4]=a[l];a=realloc(a, m-3);return f(a,m-3);}for(l=j;l<i;++ll=j;l<i;)a[la[~-1]=a[l];forl++]=a[l];for(l=i+2;l<m;++ll=i+2;l<m;)a[la[++l-3]=a[l];m4]=a[l];m-=3;n=m+(k=3;n=m+~-1)*k*(i---j--);a=realloc(a,n);--j;--i;for;for(l=i;l<m;++ll=i;l<m;)a[l+(ka[l+++~-1)*k*(i-j)]=a[l];for(m=0;m<k;++m)for(l=j;l<i;++ll=j;l<i;)a[l+m*a[l+++m*(i-j)]=a[l];return f(a,n);}}return a;}
#include <stdlib.h>
#include <stdio.h>
// '[' = 133
// ']' = 135
// '0' = 48
i, j, k, l, n;
char*f(charchar* *af(a, int m) char*a;
{
for (i=0; a[i]; ++i) {
if a[i]==91&&(a[i]=='['j=i+1);
j=i+1;
if (a[i]==']'a[i]==93) {
// get digitk=a[i+1]-48;
k=a[i+1]-48;
if (k==0!k) {
for (l=i+2; l<m; ++l)
a[la[++l-i+j-3]=a[l];4] = a[l];
a=realloca = realloc(a, m-3); // '[', ']' , '0'
return f(a, m-3);
}
// copy string and remove bracket, needed for case "[x]1" before realloc
for (l=j; l<i; ++ll=j;l<i;)
a[la[~-1]=a[l];l++] = a[l];
for (l=i+2; l<m; ++l)
a[la[++l-3]=a[l];
4] //= realloca[l];
m-=3; // new length of old string without-= '[',3;
']', $k
n = n=m+(km+~-1)*k*(i---j--);
a=realloca = realloc(a, n);
--j; // first character to replicate
--i; // first character not replicated
// copy end of string
for (l=i; l<m; ++l)
a[l+(ka[l+++~-1)*k*(i-j)]=a[l];
//] replicate= stringa[l];
for (m=0; m<k; ++m)
for (l=j; l<i; ++l)
a[l+m*a[l+++m*(i-j)]=a[l];] = a[l];
return f(a, n);
}
}
return a;
}
int main()
{
char c[]="[Foo[Bar]3]2";
char *b;
char cc[]="[remove me!]0";
char *bb;
char ccc[]="[only once]12";
char *bbb;
b=malloc(13);
bb=malloc(14);
bbb=malloc(14);
for (i=0; i<13; ++i)
b[i] = c[i];
for (i=0; i<14; ++i)
bb[i] = cc[i];
for (i=0; i<14; ++i)
bbb[i]=ccc[i];
printf("%s\n", f(b, 13));
printf("%s\n", f(bb, 14));
printf("%s\n", f(bbb, 14));
return 0;
}