DEV Community

Cover image for TryHackMe : Overheard at Breakfast
Yogeshwar Peela
Yogeshwar Peela

Posted on • Originally published at exploitnotes.hashnode.dev

TryHackMe : Overheard at Breakfast

#cybersecurity #ctf #writeup #tryhackme

TL;DR

A single artifact - a zipped screenshot of a Discord-style DM conversation

  • is the entire challenge. Two "Byte Lotus Hotel" guests, Ponzi and Lambo!, chat about social media; Lambo! name-drops a defunct profile-linking tool ("started with a G") and hands over an email address as their "best way of communication." Hashing that email and querying it against Gravatar's public API returns a cached profile - never fully deleted - whose bio field contains a base64-encoded flag planted for whoever tracks it down.

Flag: THM{[REDACTED]}

1. The artifact 

unzip overheard-at-breakfast-*.zip
Archive:  overheard-at-breakfast-*.zip
  inflating: conversation.png

file conversation.png
conversation.png: PNG image data, 1175 x 781, 8-bit/color RGBA, non-interlaced
Enter fullscreen mode Exit fullscreen mode

Just one PNG inside the zip. No accompanying text, hints, or extra files

  • whatever's needed is either in the image's metadata, hidden in the pixels, or visible on screen.

2. Ruling out metadata and steganography

Standard checks first, all of which came back clean or as false leads:

exiftool conversation.png
# Only standard PNG chunk info (IHDR, sRGB, gAMA, pHYs) - nothing hidden

binwalk conversation.png
0    0x0    PNG image, 1175 x 781, 8-bit/color RGBA, non-interlaced
91   0x5B   Zlib compressed data, compressed
# This is just the PNG's own internal IDAT chunk being correctly
# identified - not a second file appended after IEND.

steghide extract -sf conversation.png
steghide: the file format of the file "conversation.png" is not supported.

stegseek conversation.png /usr/share/wordlists/rockyou.txt
[!] error: the file format of the file "conversation.png" is not supported.
# steghide/stegseek only support JPEG/BMP/WAV/AU - PNG was never a
# candidate for these tools in the first place.

zsteg conversation.png
b4,rgb,msb,xy .. text: "UWuUWuUWuUWuUWuUWuUWuU..."
# Repeating 4-byte cycle - a bitplane artifact from ordinary image
# content aliasing into printable bytes, not a real hidden message.
Enter fullscreen mode Exit fullscreen mode

None of the classic image-forensics angles panned out. Given the file is
literally named conversation.png, the next logical step was to stop
treating it as a puzzle to crack open and just read it.

3. Reading the screenshot

Opening the image directly reveals a two-person Discord DM between
Ponzi - Influencer and Lambo!, both wearing a L3AK server badge, set
at a "Byte Lotus" resort. The key exchange:

Lambo!: Yeah nowadays I don't really use much social media...
Though I'm still out there, I used to use this free tool that let me
upload my profile and link other media accounts, was neat, until I
wiped everything. Started with a G if I remember correctly.
But if anything this is my best way of communication:
lambobytelotushotel@gmail.com

That's a direct pointer to Gravatar - a free service (starts with G)
built around uploading a profile photo and linking social accounts, keyed
entirely off a hashed email address.

4. Hashing the email and querying Gravatar

Gravatar profiles are addressable by the MD5 (legacy API) or SHA256
(current v3 API) hash of a lowercased, trimmed email address:

import hashlib
email = 'lambobytelotushotel@gmail.com'.strip().lower()
print('MD5   :', hashlib.md5(email.encode()).hexdigest())
print('SHA256:', hashlib.sha256(email.encode()).hexdigest())
Enter fullscreen mode Exit fullscreen mode 
MD5   : d4a5fc5d3128890778667e24617d7cc0
SHA256: d43faafe9d7f056793bd037b8d6e321acad985c222d83775b10d6539e301e931
Enter fullscreen mode Exit fullscreen mode

Queried both API generations:

curl -s https://www.gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json | jq .
# (empty - legacy endpoint returned nothing for this hash)

curl -s https://api.gravatar.com/v3/profiles/d43faafe9d7f056793bd037b8d6e321acad985c222d83775b10d6539e301e931 | jq .
Enter fullscreen mode Exit fullscreen mode 
{
  "hash": "d43faafe9d7f056793bd037b8d6e321acad985c222d83775b10d6539e301e931",
  "display_name": "Lambo",
  "profile_url": "https://gravatar.com/cheerfullysongf28e3c3716",
  "avatar_url": "https://1.gravatar.com/avatar/d43faafe9...",
  "location": "Byte Lotus Hotel",
  "description": "Funny thing about email hashes, they follow you places you didn't expect. Glad you found the right corner of the internet! Here is your prize: VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9",
  "pronunciation": "Lam-boh",
  ...
}
Enter fullscreen mode Exit fullscreen mode

Despite "wiping everything" per the chat log, the v3 API still returned a
full cached profile - display_name: Lambo, location: Byte Lotus Hotel

  • confirming this is the right target and that Gravatar profile data persists (or is cached) even after a user believes it's gone.

5. Decoding the flag

The description field isn't an actual bio - it's a base64 string left
there deliberately as the prize:

echo "VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9" | base64 -d
THM{[REDACTED]}
Enter fullscreen mode Exit fullscreen mode

Techniques used

# Technique Detail
1 Screenshot/artifact review The flag path only became clear after actually reading the conversation text rather than continuing to run steganography tooling against the wrong file format.
2 OSINT pivot from a leaked email A casually-shared email address in a chat log was the pivot point for the entire challenge.
3 Gravatar hash-based profile lookup Gravatar profiles are addressable purely from a hash of an email address - no authentication or account access needed to view public profile data.
4 "Deleted" data persistence The target believed they'd wiped their Gravatar profile; the API still served cached/persisted data, including a message clearly left for someone doing exactly this lookup.

Chain 

Zipped PNG (conversation.png) - a "Byte Lotus Hotel" Discord DM screenshot
        │
        ▼
Lambo! mentions a defunct "G" profile-linking tool + shares an email
        │
        ▼
Hash email (MD5 / SHA256)
        │
        ▼
Query Gravatar API (api.gravatar.com/v3/profiles/<sha256>)
        │
        ▼
Cached profile returned despite "wiping everything"
        │
        ▼
description field → base64 → flag
Enter fullscreen mode Exit fullscreen mode

Takeaways / lessons (from a defensive OSINT-awareness angle)

  • Email addresses shared casually in chat are trivially pivotable to public profile services like Gravatar, which are keyed purely off an email hash - no breach or account compromise required.
  • "Deleting" a profile on a linked service doesn't always mean the data is gone from every cache or API response; assume public profile data set at any point may resurface.
  • If reusing the same email across services, consider that hash-based lookups (Gravatar being the most common example) let anyone correlate an email to whatever profile data was ever associated with it.

Top comments (0)