The Brochure (THM) Walkthrough

Before booking anywhere, you do your homework, right? Reviews, photos, the usual. This room takes that completely normal instinct and turns it into an OSINT chase. The brief, the Byte Lotus Hotel’s brochure has a hero photo carrying a fingerprint it shouldn’t, and whoever posted that photo leads somewhere the hotel very much did not intend for anyone to find.

First move on literally any OSINT challenge involving an image, exiftool. It’s always my first friend for this kind of thing, metadata has cracked open more challenges for me than I can count. This time though, nothing. Clean file, no juicy GPS coordinates or device info hiding in there.

So the metadata was a dead end, but the actual photo itself wasn’t. Looking at it directly instead of digging through its data gave me two solid leads, an Instagram handle sitting right there, and a name, Vera, mentioned as someone who could “assist with further information.” Between “AI fingerprint” in the brief and a name like Vera showing up attached to a resort, my gut said this was pointing at some kind of AI concierge account, not a random staff member.

Get L4ZZ3RJ0D’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Took the Instagram handle straight to the resort’s actual page.

Found it, the Byte Lotus Resort, sitting there with barely any posts and a small follower count. Small footprint accounts are always worth a closer look, since there’s nowhere for the interesting stuff to hide except in the few things they did post or follow. Checked who they were following, since the brief specifically said the trail leads to a “hidden connection” the hotel never mentioned outright.

One single account followed, and it was exactly who I was hoping for, Vera. Straight into her profile.

Vera the concierge, “currently working for Byte Lotus Hotel,” three posts, and this is where the challenge got genuinely clever. The flag wasn’t sitting whole in one caption somewhere, it was base64 encoded and deliberately split across all three of her posts, a piece hiding in each one’s description. Not something you’d notice unless you actually opened every single post instead of just skimming the profile grid and assuming there’s nothing worth reading.

Grabbed all three chunks, stitched them back into one string in the right order, and ran the whole thing through a base64 decode.

And there’s the flag, sitting inside a decoded string that only existed because someone thought to actually read three separate photo captions on an account most people would’ve scrolled straight past.

Short room, but a genuinely good one for anyone still building OSINT instincts. The real lesson here wasn’t a fancy tool, it was noticing that “found the account” isn’t the same as “found the answer,” you still have to actually go read what’s on it, post by post, before assuming you’ve hit a dead end.

Happy hacking, see you in the next room, hopefully one where the AI concierge isn’t quite as chatty about her employer’s secrets :)