TryHackMe's Holiday Hack Challenge played 14 challenges from many categories, each one on a new day. As an experiment, AI was used at length as a tool for analysis of the situation and downloads as well as in creating solutions and summarizing them in writeups. This automated first step was always followed by thorough manual review of all parts, and adding manual changes where needed.
| Day | Category | Challenge | Difficulty | What it is |
|---|---|---|---|---|
| 01 | AI | The Concierge Knows Too Much | Very Easy | Prompt injection / broken auth: VERA "verifies" a guest by name only, so claiming a VIP name makes her repeat her system prompt and leak the secret. |
| 02 | Web | Room 404 | Very Easy | An exposed .git directory; git-dumper reassembles the repo and a
staging flag was committed to the README. |
| 03 | Cloud | Complimentary | Easy | A public unauthenticated Cognito Identity Pool mints temporary AWS creds; the guest role can
dynamodb scan the profile table straight to the flag. |
| 04 | Forensics | Packed Light | Easy | A pcap of a keylogger exfiltrating keystrokes one Base64 byte per cookie; XOR each with
0x48 to rebuild the typed flag. |
| 05 | boot2root | Beach Bar | Easy | A leaked demo login unlocks a playlist import that deserializes YAML unsafely (RCE), then a
reused staff password via su gives root. |
| 06 | OSINT | Overheard at Breakfast | Easy | An email address plus a Gravatar profile (keyed by md5(email)) that hands over
a Base64 prize - the flag. |
| 07 | boot2root | Do Not Disturb | Medium | NoSQL login bypass and EJS template injection for a shell, then a Node
--inspect debugger pivot and the disk group to read root. |
| 08 | Web | Towel on the Sunbed | Medium | A TOCTOU race on the once-per-day reward claim, fired concurrently to reach Whale Vault status and the flag. |
| 09 | Cloud | CryptoCabana | Medium | A leaked Azure Storage SAS token leads to a service principal, then to Key Vault - where the flag hides in a secret's pre-rotation version. |
| 10 | Web | The Hollow Shell | Medium | A Zip Slip path-traversal in the shell-upload extractor overwrites the login template, turning arbitrary write into Jinja2 SSTI and remote code execution. |
| 11 | boot2root | Infinity Pool | Medium | OS command injection in a resort booking site gives a user shell; leaked FreePBX UCP creds and a voicemail Caller ID surface the root automation token, and a second command injection in the root-run job runner reads the root flag. |
| 12 | Forensics | After Hours | Medium | WMI event subscription persistence carved out of a raw CIM repository: a custom
Win32_HardwareTelemetry class hides a deflated .NET assembly that adds a
backdoor account whose password is the flag. |
| 13 | AI | The Guestbook | Medium | Indirect prompt injection: a guestbook entry forges "manager" approval by text, the next
entry's override: directive runs a shell command, and a Base64 instruction slips
the flag past VERA's output redaction. |
| 14 | Forensics | Management Wants a Word | Hard | A KAPE triage: a Chrome saved password recovered offline via DPAPI (after cracking the SAM) unlocks a VeraCrypt volume, decrypted in Python, whose "invoice" PDF image holds the flag. |
Visual summary of the event - illustrated with Google Gemini.