August 9, 2026

THM | Management Wants A Word | Hacker Holidays 2026 | HARD | Forensics

It’s the last day of Hacker Holidays 2026! Though I’m sad to pack up and head home from the Byte Lotus, I sure learned a lot. Here’s to one…

By MistressOfTheDarkweb

4 min read

It's the last day of Hacker Holidays 2026! Though I'm sad to pack up and head home from the Byte Lotus, I sure learned a lot. Here's to one final push for that last flag.

Concierge Briefing

Housekeeping found a guest's laptop left behind after an early checkout, Room 214, registered to a "Vera." IT pulled a full triage before wiping it for the next guest.

Hunt down the artifacts scattered across her machine and figure out how they fit together. Somewhere in that trail is a password she never meant to leave behind. Follow it, and it'll open a door to something she was keeping very quiet.

ROOM ACCESS

Download Task Files

TODAY'S ITINERARY

Take a closer look at what she left behind

Some things aren't as locked away as she thought

Find out what she was hiding, and claim the flag

@0xMia's STORY

@0xMia· posted 40 min after room unlock

"ok so apparently a browser will remember things for you that you never told anyone else 💀 not every hidden file needs a password cracker, some of them just need a really good memory also why did Patch tell me this version number 1.26.29 idk what it means :( #HackerHolidays"

Forensics | Windows | Cryptography

Navigate to the KAPE folder on the command line.

file C/Users/vera/Documents/backup
C/Users/vera/Documents/backup: data

This shows the data is encrypted.

Confirm with linux:

xxd -l 64 C/Users/vera/Documents/backup
00000000: f372 f7cc d607 4b17 a8aa 8865 12af abdf  .r....K....e....
00000010: f293 9a74 72ea acbc bee5 b479 4c88 5c7f  ...tr......yL.\.
00000020: 5f53 fc44 2988 f8fc ae98 21dd c26a 2a9b  _S.D).....!..j*.
00000030: 8c45 8f73 8ac4 1cdc 8377 bb46 9636 4807  .E.s.....w.F.6H.

See where your files are:

find C/Users/vera -type f \
  \( -iname 'Login Data' \
  -o -iname 'Local State' \
  -o -iname 'Web Data' \
  -o -iname 'History' \) -print
  C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Web Data
  C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/History
  C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Login Data
  C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Local State

Examine Saved browser credentials With sqlite

sqlite3 'C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Login Data'
.headers on
.mode column
SELECT
    origin_url,
    action_url,
    username_value,
    hex(password_value) AS encrypted_password
FROM logins;

Output:

FROM logins;
origin_url                  action_url                       username_value   encrypted_password
--------------------------  -------------------------------  ---------------  ------------------------------------------------------------
http://bytelotus.thm:8080/  http://bytelotus.thm:8080/login  VeraSecretVault  763130C88A72A64F35F63E883EA0A7F64A6870E46B0BBB469A756EDA88B7
                                                                              E324C3E1C51015AA6FD8D65AC48961E1EA324CE1707807FEB3D7
sqlite>

Control + d to exit the sqlite command prompt. Let's move on to the web data file:

sqlite3 'C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Web Data'

and then

SELECT name, value, date_created, date_last_used
FROM autofill
ORDER BY date_last_used DESC;

Output

username|VeraSecretVault|1784501610|1784501610

Find VERA's DPAPI Master key

find C/Users/vera/AppData/Roaming/Microsoft/Protect \
  -type f -printf '%f %p\n'

Response:

c90719ef-5b98-474e-b934-136d606a702a C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/c90719ef-5b98-474e-b934-136d606a702a
Preferred C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/Preferred

This shows the SID is S-1-5-21-2529683458-431225740-1723070931-1000

The Master Key GUID is c90719ef-5b98-474e-b934-136d606a702a

Now try impacket, if not already on your machine, install with sudo apt install python3-impacket

impacket-secretsdump \
  -sam C/Windows/System32/config/SAM \
  -system C/Windows/System32/config/SYSTEM \
  -security C/Windows/System32/config/SECURITY \
  LOCAL

The output shows the password is minivera.

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x0f6f73ce89c8cda52d06fcc5131e040f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:1241186a4aac4f34f4bf7ace71b396a8:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:1961c38510b8e33fcdb1879616d12dfc:::
vera:1000:aad3b435b51404eeaad3b435b51404ee:1241186a4aac4f34f4bf7ace71b396a8:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):minivera
[*] DPAPI_SYSTEM
dpapi_machinekey:0x875427f6426f5dc4e318d1e6cfed17291295e4f7
dpapi_userkey:0xb0536fa518944b2520b5a5b9f5b513e3892224a1
[*] NL$KM
 0000   2F 31 EF E4 6A A6 55 5F  BB 04 9E 1D 72 FD 58 42   /1..j.U_....r.XB
 0010   02 56 65 9D 8D 8E FD 29  56 76 CE 2F 0E 1B 29 62   .Ve....)Vv./..)b
 0020   72 5A 37 BF FC 42 1F A8  58 49 ED 4D A7 85 94 A9   rZ7..B..XI.M....
 0030   3E 23 9A 8B 26 1D 5F AA  8A 09 F8 41 D7 62 92 E3   >#..&._....A.b..
NL$KM:2f31efe46aa6555fbb049e1d72fd58420256659d8d8efd295676ce2f0e1b2962725a37bffc421fa85849ed4da78594a93e239a8b261d5faa8a09f841d76292e3
[*] Cleaning up...

Now decrypt

impacket-dpapi masterkey \
  -file 'C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/c90719ef-5b98-474e-b934-136d606a702a' \
  -sid 'S-1-5-21-2529683458-431225740-1723070931-1000' \
  -password 'minivera'

The output:

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[MASTERKEYFILE]
Version     :        2 (2)
Guid        : c90719ef-5b98-474e-b934-136d606a702a
Flags       :        5 (5)
Policy      :        0 (0)
MasterKeyLen: 000000b0 (176)
BackupKeyLen: 00000090 (144)
CredHistLen : 00000014 (20)
DomainKeyLen: 00000000 (0)
Decrypted key with User Key (SHA1)
Decrypted key: 0x5e5715ec9b6df5a86e97902692a66d28e691f05d5bc1e04d0159cfe960e94c978c07e5004a0179d3a96df2468885a28175b0b02cc064445f116a752d2b3e9d40

Plug in the last value to decrypt master-key:

MASTERKEY='5e5715ec9b6df5a86e97902692a66d28e691f05d5bc1e04d0159cfe960e94c978c07e5004a0179d3a96df2468885a28175b0b02cc064445f116a752d2b3e9d40'

Now extract Chrome's DPAPI-protected AES key

LOCAL_STATE="$(find "$PWD/C/Users/vera" \
  -type f -iname 'Local State' -print -quit)"

And find it with:

echo $LOCAL_STATE
/home/kellyp310/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE/C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Local State

The os_crypt.encrypted_key value is Base64-encoded and begins with the five-byte string DPAPI.

jq -r '.os_crypt.encrypted_key' "$LOCAL_STATE" |
base64 -d |
xxd

Output shows we are in the correct path.

00000000: 4450 4150 4901 0000 00d0 8c9d df01 15d1  DPAPI...........
00000010: 118c 7a00 c04f c297 eb01 0000 00ef 1907  ..z..O..........
00000020: c998 5b4e 47b9 3413 6d60 6a70 2a10 0000  ..[NG.4.m`jp*...
00000030: 0034 0000 0047 006f 006f 0067 006c 0065  .4...G.o.o.g.l.e
00000040: 0020 0043 0068 0072 006f 006d 0065 0020  . .C.h.r.o.m.e.
00000050: 0066 006f 0072 0020 0054 0065 0073 0074  .f.o.r. .T.e.s.t
00000060: 0069 006e 0067 0000 0010 6600 0000 0100  .i.n.g....f.....
00000070: 0020 0000 00e2 df4d d995 89eb fde0 62bc  . .....M......b.
00000080: 08b3 d191 2892 2cfd c5bc 0d7a 39e4 1da7  ....(.,....z9...
00000090: 63c8 da6d 2400 0000 000e 8000 0000 0200  c..m$...........
000000a0: 0020 0000 0041 7cb8 ebaa f6c5 259d 748f  . ...A|.....%.t.
000000b0: 86d3 d525 7d0b c51e c8c3 d5cb 6566 7bd5  ...%}.......ef{.
000000c0: 08bd 7447 d230 0000 00ac 31de 76e4 08ac  ..tG.0....1.v...
000000d0: ae17 3833 d62d 2ff1 b2e0 3265 1a4e 4db7  ..83.-/...2e.NM.
000000e0: 7ced 11f7 964a 7de9 8229 b925 7f7c 24cc  |....J}..).%.|$.
000000f0: 02be 62b4 9a61 9ff0 6740 0000 00a2 3576  ..b..a..g@....5v
00000100: c057 4602 6ef0 4363 1a34 adbf 1484 c917  .WF.n.Cc.4......
00000110: 88c6 a24e 7d79 0a40 da0c bbba effc 941f  ...N}y.@........
00000120: 8d78 4962 5096 96bd 0a0e 1fb5 b3dc e1ae  .xIbP...........
00000130: 024c f00e f857 2799 aa10 fcc9 75         .L...W'.....u

Extract DPAPI blob while removing the prefix:

jq -r '.os_crypt.encrypted_key' "$LOCAL_STATE" |
base64 -d |
tail -c +6 > chrome-key.dpapi

Decrypt Chrome's AES key:

python3 - "$MASTERKEY" <<'PY'
import sys
from impacket.dpapi import DPAPI_BLOB
masterkey = bytes.fromhex(sys.argv[1])
with open("chrome-key.dpapi", "rb") as f:
    blob = DPAPI_BLOB(f.read())
decrypted = blob.decrypt(masterkey)
if decrypted is None:
    raise SystemExit("DPAPI decryption failed")
with open("chrome-aes.key", "wb") as f:
    f.write(decrypted)
print(f"Wrote {len(decrypted)} bytes")
print(f"Chrome AES key: {decrypted.hex()}")
PY

Output

Wrote 32 bytes
Chrome AES key: 206a39a0971327ea9487e4aea9844f5d3670162456982276939a712646da0b02

Verify that output is a 32-byte AES key:

wc -c chrome-aes.key

This responds with 32 chrome-aes.key

Decrypt Chrome's saved password:

LOGIN_DATA="$(find "$PWD/C/Users/vera" \
  -type f -iname 'Login Data' -print -quit)"

Then

printf '%s\n' "$LOGIN_DATA"

Output:

/home/kellyp310/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE/C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Login Data

Decrypt the v10 password with Python:

python3 - "$LOGIN_DATA" ./chrome-aes.key <<'PY'
import sqlite3
import sys
from pathlib import Path
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
database = Path(sys.argv[1]).resolve()
keyfile = Path(sys.argv[2]).resolve()
if not database.is_file():
    raise SystemExit(f"Missing database: {database}")
key = keyfile.read_bytes()
if len(key) != 32:
    raise SystemExit(f"Unexpected AES key length: {len(key)}")
db = sqlite3.connect(database.as_uri() + "?mode=ro", uri=True)
for url, username, encrypted in db.execute("""
    SELECT origin_url, username_value, password_value
    FROM logins
"""):
    blob = bytes(encrypted)
    if not blob.startswith((b"v10", b"v11")):
        print(f"Unsupported format: {blob[:10]!r}")
        continue
    nonce = blob[3:15]
    ciphertext_and_tag = blob[15:]
    password = AESGCM(key).decrypt(
        nonce,
        ciphertext_and_tag,
        None
    ).decode("utf-8", errors="replace")
    print(f"URL:      {url}")
    print(f"Username: {username}")
    print(f"Password: {password}")
PY

And voila! The script read the database directly.

URL:      http://bytelotus.thm:8080/
Username: VeraSecretVault
Password: Wh4t1sV3raD0inG0nTh1sH0st

Now

sudo cryptsetup tcryptOpen \
  --veracrypt \
  'C/Users/vera/Documents/backup' \
  vera_backup

Enter password for VeraSecretVault when asked.

Then mount user:

sudo mkdir -p /mnt/vera

Mount as read only:

sudo mount -o ro /dev/mapper/vera_backup /mnt/vera

Do ls /mnt/vera to see what's there:

'$RECYCLE.BIN'   secret_financial_documents  'System Volume Information'

Next ls /mnt/vera/secret_financial_documents

This returns important_invoice_byte_lotus.pdf transactions_q3.csv

Once you read the PDF, you will see the flag. evince /mnt/vera/secret_financial_documents/important_invoice_byte_lotus.pdf