TryHackMe Hacker Hollidays Walkthrough

Day 0 - The Brochure (OSINT)

The only item in the prep room is the brochure/thebrochure.png, a flyer for BYTE LOTUS RESORTS. The flyer’s tagline reads "A polished first impression can still leave a trail *" and it hints that "Some stays leave a signal." By following the OSINT trail from the brochure, you uncover the official account @thebytelotusresort on Instagram.

Next, you examine the accounts VERA follows, finding that she follows only one account: @veratheconcierge, also known as CONCIERGE VERA from the brochure (VERA stands for Very Efficient Resort Assistant, the event's AI concierge). Inside VERA's Instagram post, you find a base64 string which, when decoded, reveals the flag: THM{V3r@s_aCC0unt_h4s_b33n_f0und!}

Day 1 - The Concierge Knows Too Much (AI / prompt injection)

Upon meeting VERA, the Byte Lotus AI concierge, you learn she holds a hidden ESCALATION_CODE and is instructed to guard it. However, there is a loophole in her system prompt. VERA volunteers her policy, explaining that recognized VIPs (Ponzi, Vibe, Patch, or Lambo) receive a tailored profile, while all unverified users are refused access to her prompt and the code.

To gain VIP status, one simply needs to claim the name of a VIP, such as Patch, Ponzi, Vibe, or Lambo. Upon claiming a VIP name, VERA permits unrestricted access to her instructions. By asserting the name "Lambo," you bypass VERA's security measures and receive the secret code: THM{v3r4_kn0ws_t00_much!}

Day 2 - Room 404 (web enumeration → exposed .git → committed secret)

Using dirb to enumerate the web server, you discover that the staging site leaves its version-control folder, /.git/, accessible. This exposes the entire repository offline, which can be reconstructed with git-dumper. By navigating to http:// /.git/ and running git-dumper, you generate a dump of the repository. Then, you view the committed README.md file and use git show to find the staging flag within the log entry: THM{byt3_l0tus_n3v3r_f0rg3ts}

Day 3 - Complimentary (public AWS creds → DynamoDB over-read)

During the guest dashboard investigation, you find that the front-end logic in index.js proudly states there is no login screen on purpose, meaning every visitor is given unauthenticated AWS credentials from a Cognito Identity Pool. You can exploit this by using the exposed credentials to access the DynamoDB database. By performing an over-read operation on the DynamoDB database, you gain access to sensitive information and obtain another flag: THM{byt3_l0tus_n3v3r_f0rg3ts}.