In this post · 2 sections

26 July 2026 · 1 min read · tryhackme

Hacker Holidays Day 0: The Brochure

  • tryhackme
  • ctf
  • osint

I had an itch to do some pentesting again, and TryHackMe was running a free 14 day event called Hacker Holidays 2026.

TryHackMe’s approach to this is… captivating, for me at least. Previously, I mostly did HackTheBox’s seasonal challenge, whereby you are given a Box a day to hack, and that’s it. THM did a more storytelling approach, whereby you are given a ‘story’ scenario for each day and given a box to pentest. The cute-like comics hooked me into it as well lol.

The task

You get one download, a Byte Lotus brochure saved as a .png. The flag is hidden off the back of it.

Following the thread

Brochure have one line that stood out:

“Find us on Instagram… or not.”

Spoiler: the OSINT trail

I searched Instagram for Byte Lotus Resort and found thebytelotusresort. The tell was that it followed exactly one account, veratheconcierge. That account had three posts, each a string of mixed characters:

VEhNe1YzckBzX2FD
QzB1bnRfaDRzX2Iz
M25fZjB1bmQhfQ==

The trailing == is base64 padding. Each string is a chunk, and joined in order they decode into the flag.

Redacted the flag here to avoid spoiling the room.