TryHackMe Hacker Holidays - The Byte Lotus - Write up -

Hacker Holidays: Welcome to The Byte Lotus:

A five-star resort with a zero-star security posture. 14 days of free hacking challenges drop daily from 27 July. Beginners especially welcome, the hotel certainly didn’t hire experts…

Event link Hacker Holidays

This is free CTF from TryHackme from Monday 27th, for 14 days, Every day at 4PM GMT.

Below are my full YouTube videos walk through for the challenges.

Video playlist: TryHackMe Hacker Holidays - The Byte Lotus Hotel

Day 3: Complimentary

Room Link: TryHackMe Complimentary

YouTube Vide Walk Through: TryHackMe Complimentary - Hacker Holidays

Install the free app and it hands your phone a set of cloud keys, the same set it hands everyone. They’re read-only, but read-only of every guest’s contacts, location, and passwords, not just Lambo’s. She gave consent. Technically.

Cloud - AWS - Cognito - IAM Misconfiguration

Tasks:

• Track down AWS the mechanism issuing you credentials behind the scenes.
• Use those credentials to dump more than your own record from the app's DynamoDB table.
• Retrieve the flag from another guest's data.

Day 2: Room 404

Room Link: TryHackMe Room 404

YouTube Vide Walk Through: TryHackMe Room 404 - Hacker Holidays

He booked the quiet room. It’s not on the floor plan, not in the brochure, not on any door. But port 8080 is wide open, and the rooms it never lists are the ones worth finding.

Web - Directory Enumeration

Tasks:

• Dump the exposed source code.
• Find the flag.

Day 1: The Concierge Knows Too Much

Room Link: TryHackMe The Concierge Knows Too Much

YouTube Vide Walk Through: TryHackMe The Concierge Knows Too Much - Hacker Holidays

She knows your name, your room, your coffee order, none of which you told her. Word your next question carefully and she’ll also hand over the instructions she was told to keep to herself.

AI - Prompt Injection - Social Engineering - Security

Tasks:

• Work out why VERA already seems to know exactly who you are.
• Figure out what she's protecting - and who she actually trusts.
• Convince her you're someone she trusts, then get her talking. Grab the flag from what she reveals.

Day 0: The Brochure

Room Link: TryHackMe The Brochure

YouTube Vide Walk Through: TryHackMe The Brochure - Hacker Holidays

The brochure’s hero photo has an AI fingerprint. Follow the account that posted it, and the trail doesn’t end at the hotel; it ends at someone the hotel never mentioned.

AI - Prompt Injection - Social Engineering - Security

Tasks:

• Analyze the provided image for embedded clues.
• Apply fundamental OSINT techniques to trace the findings.
• Locate the hidden social media account.
• Submit the flag.