DEV Community

Cover image for [TryHackMe Writeup] Overheard at Breakfast
Wahiduddin Samani
Wahiduddin Samani

Posted on

[TryHackMe Writeup] Overheard at Breakfast

#cybersecurity #osint #challenge #security

🏨 Hacker Holidays — The Byte Lotus Hotel

🍳 Overheard at Breakfast — Full Walkthrough

Detail Value
Points 60
Category OSINT
Difficulty Easy
Tags OSINT, Social Media, Hashing

**📝 Challenge Description

**

The breakfast terrace is loud this morning — clinking cutlery, espresso machines, the usual chatter. One guest couldn't help but linger at a nearby table, seeing more of a conversation than they were meant to.

When the table's occupant stepped away for a refill, they seized the moment and grabbed a screenshot before it could disappear. Somewhere in that conversation is enough to track down an account nobody was supposed to find.

Objective: Analyze the provided conversation screenshot, extract identifying details, locate a hidden account, and capture the flag.

🗺️ Solution Overview 

┌─────────────────────────────┐
│  1. Analyze Conversation    │
│         ↓                   │
│  2. Extract Key Clues       │
│         ↓                   │
│  3. Compute MD5 Hash        │
│         ↓                   │
│  4. Find Gravatar Profile   │
│         ↓                   │
│  5. Extract Base64 String   │
│         ↓                   │
│  6. Decode the Flag 🚩      │
└─────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Step 1: Analyze the Conversation 🔍

The challenge provides a screenshot of a Discord conversation between two users:

  • Ponzi – Influencer (L3AK member)
  • Lambo! (our target)

The Conversation Screenshot

Full Conversation Transcript

Time User Message
10:53 PM Ponzi – Influencer Hey @lambo!
10:53 PM Lambo! Hi Ponzi! How are things going on your end? :)
10:54 PM Ponzi – Influencer doing well thanks for asking, enjoying the resort so far?
10:55 PM Lambo! Absolutely, Byte Lotus is treating me nice, love the food, weather and overall vibes. Will probably come back next year too.
10:57 PM Ponzi – Influencer love to hear it!!! so i've been posting so much on social media and helping customers around. i never ended up getting your handle, so that i could possibly tag you next time.
11:00 PM Lambo! Great to hear, I've been seeing those awesome posts. Yeah nowadays I don't really use much social media...
Though I'm still out there, I used to use this free tool that let me upload my profile and link other media accounts was neat, until I wiped everything. Started with a G if I remember correctly.
But if anything this is my best way of communication: lambobytelotushotel@gmail.com
11:03 PM Ponzi – Influencer woah woah, seems very secretive! maybe for the better that you don't use social media, heard some strange things have been happening in Byte Lotus. thanks regardless I will be in touch with you.
btw one more thing, going out to breakfast tomorrow morning?
11:03 PM Lambo! Yeah sounds dope, will be there you know me 😎!

Step 2: Extract Key Clues 🔑

From the conversation, we can identify three critical clues:

Clue #1 — Email Address 

lambobytelotushotel@gmail.com
Enter fullscreen mode Exit fullscreen mode

Lambo directly shares their email as their "best way of communication."

Clue #2 — The Mystery Tool (Starts with "G")

"I used to use this free tool that let me upload my profile and link other media accounts... Started with a **G* if I remember correctly."*

This is Gravatar (https://gravatar.com) — a free service that:

  • ✅ Lets you upload a profile picture
  • ✅ Lets you link other social media accounts
  • ✅ Starts with the letter "G"
  • ✅ Uses email hashes to look up profiles (connects to the "Hashing" tag)

Clue #3 — Challenge Tags

The challenge is tagged with OSINT, Social Media, and Hashing — confirming we need to:

  1. Use OSINT techniques to find a profile
  2. The profile is on a social/media platform
  3. Hashing is involved (Gravatar uses MD5 hashes of emails)

**Step 3: Compute the MD5 Hash 🔐

**
Gravatar identifies users by the MD5 hash of their email address. This is how you look up anyone's Gravatar profile if you know their email.

The Process 

Email (lowercase, trimmed) → MD5 Hash → Gravatar Profile URL
Enter fullscreen mode Exit fullscreen mode

PowerShell Script 

# Compute MD5 hash of email
$email = 'lambobytelotushotel@gmail.com'
$md5 = [System.Security.Cryptography.MD5]::Create()
$bytes = [System.Text.Encoding]::UTF8.GetBytes($email.Trim().ToLower())
$hash = $md5.ComputeHash($bytes)
$hashString = -join ($hash | ForEach-Object { $_.ToString('x2') })
Write-Output "MD5 Hash: $hashString"
Enter fullscreen mode Exit fullscreen mode

Alternative — Python 

import hashlib
email = "lambobytelotushotel@gmail.com"
md5_hash = hashlib.md5(email.strip().lower().encode('utf-8')).hexdigest()
print(f"MD5 Hash: {md5_hash}")
Enter fullscreen mode Exit fullscreen mode

Alternative — Linux/Bash 

echo -n "lambobytelotushotel@gmail.com" | md5sum
Enter fullscreen mode Exit fullscreen mode

Alternative — CyberChef

  1. Go to CyberChef
  2. Search for "MD5" in Operations
  3. Input: lambobytelotushotel@gmail.com
  4. Output: d4a5fc5d3128890778667e24617d7cc0

Result 

MD5("lambobytelotushotel@gmail.com") = d4a5fc5d3128890778667e24617d7cc0
Enter fullscreen mode Exit fullscreen mode

**Step 4: Find the Gravatar Profile 🌐

**
Using the MD5 hash, we can construct the Gravatar profile URL:

Profile URL 

https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0
Enter fullscreen mode Exit fullscreen mode

JSON API (for structured data) 

https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json
Enter fullscreen mode Exit fullscreen mode

What We Find

Visiting the profile URL reveals Lambo's Gravatar profile with the following details:

Field Value
Display Name Lambo
Pronunciation Lam-boh
Location Byte Lotus Hotel
Username cheerfullysongf28e3c3716
Profile URL https://gravatar.com/cheerfullysongf28e3c3716

The "About Me" Section — The Prize 🎯

The profile's "aboutMe" field contains this message:

"Funny thing about email hashes, they follow you places you didn't expect. Glad you found the right corner of the internet! Here is your prize:
VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9"

Raw JSON Response 

{
  "entry": [{
    "hash": "d4a5fc5d3128890778667e24617d7cc0",
    "profileUrl": "https://gravatar.com/cheerfullysongf28e3c3716",
    "displayName": "Lambo",
    "pronunciation": "Lam-boh",
    "aboutMe": "Funny thing about email hashes, they follow you places you didn't expect. Glad you found the right corner of the internet! Here is your prize: VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9",
    "currentLocation": "Byte Lotus Hotel"
  }]
}
Enter fullscreen mode Exit fullscreen mode

**Step 5: Identify the Encoding 🧬

**
The "prize" string is clearly Base64 encoded:

VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9
Enter fullscreen mode Exit fullscreen mode

How to recognize Base64:

  • ✅ Contains only alphanumeric characters, +, /, and = (padding)
  • ✅ The character set (uppercase, lowercase, digits) is typical of Base64
  • ✅ The challenge tags include "Hashing" — pointing to encoding/decoding
  • ✅ Starts with VEhN which is a known Base64 prefix for THM (TryHackMe flags)

Quick Reference: Common THM Flag Base64 Prefixes

Base64 Start Decoded
VEhN THM
VEhNe THM{

Step 6: Decode the Flag 🚩

PowerShell 

$encoded = 'VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9'
$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($encoded))
Write-Output "Flag: $decoded"
Enter fullscreen mode Exit fullscreen mode

Python 

import base64
encoded = 'VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9'
decoded = base64.b64decode(encoded).decode('utf-8')
print(f"Flag: {decoded}")
Enter fullscreen mode Exit fullscreen mode

Linux/Bash 

echo 'VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9' | base64 -d
Enter fullscreen mode Exit fullscreen mode

CyberChef

  1. Go to CyberChef
  2. Search for "From Base64" in Operations
  3. Input: VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9
  4. Output: THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}

🏆 THE FLAG 

╔══════════════════════════════════════════════════════╗
║                                                      ║
║   THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}           ║
║                                                      ║
╚══════════════════════════════════════════════════════╝
Enter fullscreen mode Exit fullscreen mode

Decoded meaning: "Secret Profile Has Been Identified"

🧠 Skills & Concepts Covered

1. OSINT (Open Source Intelligence)

  • Extracting actionable intelligence from casual conversation
  • Identifying platform-specific clues from vague descriptions
  • Using publicly available APIs to retrieve hidden profiles

2. Social Media Investigation

  • Understanding how Gravatar works as a profile aggregation service
  • Knowing that "wiped" accounts may still have data accessible via hash lookups
  • Recognizing platform descriptions from feature-based clues

3. Hashing & Encoding

  • MD5 Hashing — Converting an email to its MD5 hash for Gravatar lookup
  • Base64 Decoding — Recognizing and decoding Base64-encoded strings

🔗 Useful Links & Tools

Tool Purpose URL
Gravatar Profile lookup via email hash https://gravatar.com
CyberChef Encoding/Decoding Swiss Army Knife https://gchq.github.io/CyberChef/
MD5 Online Quick MD5 hash generator https://www.md5online.org/
Base64 Decode Online Base64 decoder https://www.base64decode.org/

📋 Quick Reference — Complete Attack Chain 

┌──────────────────────────────────────────────────────────────┐
│                    ATTACK CHAIN SUMMARY                      │
├──────────────────────────────────────────────────────────────┤
│                                                              │
│  📸 Screenshot → Discord conversation between Ponzi & Lambo  │
│         │                                                    │
│         ▼                                                    │
│  🔍 Clue 1: Email = lambobytelotushotel@gmail.com            │
│  🔍 Clue 2: Tool starts with "G" = Gravatar                 │
│         │                                                    │
│         ▼                                                    │
│  🔐 MD5("lambobytelotushotel@gmail.com")                     │
│     = d4a5fc5d3128890778667e24617d7cc0                       │
│         │                                                    │
│         ▼                                                    │
│  🌐 https://gravatar.com/d4a5fc5d312889...                   │
│     → Profile found! aboutMe contains Base64 string          │
│         │                                                    │
│         ▼                                                    │
│  🧬 Base64 Decode:                                           │
│     VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9   │
│         │                                                    │
│         ▼                                                    │
│  🚩 FLAG: THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}           │
│                                                              │
└──────────────────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

**💡 Key Takeaways

**

  1. People reveal more than they think — Even in casual chat, Lambo shared enough info (email + tool description) to find their "hidden" profile.

  2. Gravatar profiles persist — Even if you "wipe everything," the email hash still resolves if the account exists. Gravatar profiles are often overlooked during OPSEC cleanup.

  3. MD5 hashes are deterministic — Anyone who knows your email can compute the hash and check your Gravatar profile. This is by design, not a bug.

  4. Always check for encoding — Flags and secrets are often hidden in plain sight using common encoding schemes like Base64.

  5. Cross-platform OSINT — A single email address can be the key to unlocking profiles across multiple platforms (Gravatar, Have I Been Pwned, social media lookups, etc.)

Top comments (0)