Writeup on THM Holiday Hack 2026:
Day 06 - OSINT / Overheard at Breakfast

A pure OSINT trail. The starting clue is an email address; the hint points at a free profile-linking service "starting with a G". That is Gravatar, which keys profiles by the MD5 of the email - so anyone with the address can pull the public profile, which carries the prize (a Base64 flag).

Challenge description

Two strangers. One conversation. One profile they never meant to reveal.

The breakfast terrace is loud this morning, clinking cutlery, espresso machines, the usual chatter. One guest couldn't help but linger at a nearby table, seeing more of a conversation than they were meant to.

When the table's occupant stepped away for a refill, they seized the moment and grabbed a screenshot before it could disappear. Somewhere in that conversation is enough to track down an account nobody was supposed to find.

Today's itinerary: Analyze the provided conversation for identifying details. Extract the relevant clues. Locate the hidden account. Submit the flag.

1. Download

conversation.png - the overheard exchange that hands over the email address and the "starts with a G" hint.

2. Docker/nc - what we get

No target. Everything is open-source lookups.

3. Analysis steps

3.1 The clue: an email and a "G" service (success)

Best way of communication: lambobytelotushotel@gmail.com
"a free tool that lets me upload my profile and link other media accounts ... starts with a G"

Conclusion: profile-linking, keyed by email, starting with G - Gravatar. Gravatar URLs use the MD5 hash of the (trimmed, lower-cased) email.

3.2 Hash the email -> Gravatar profile (success)

Gravatar keys profiles by the MD5 of the (trimmed, lower-cased) email. A short Node/crypto snippet (found via a Google AI answer, no link) builds the hash and the avatar URL. I ran it on OneCompiler (this draft):

const crypto = require('crypto');
const email = 'lambobytelotushotel@gmail.com';
const hash = crypto.createHash('md5').update(email.trim().toLowerCase()).digest('hex');
const avatarUrl = 'https://gravatar.com/'+hash+'?s=80';
console.log(avatarUrl)

Output:
https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0?s=80

Running the snippet on OneCompiler - it prints the Gravatar avatar/profile URL for the email's MD5 hash.

Simpler still, in hindsight - the same hash locally in one line:

$ echo -n lambobytelotushotel@gmail.com | md5sum
d4a5fc5d3128890778667e24617d7cc0  -

Conclusion: the profile confirms the lead ("email hashes follow you places you didn't expect") and hands over the prize as a Base64 string.

3.3 Decode the prize (success)

$ echo VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9 | base64 -d ; echo
THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}

FLAG = THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}

Conclusion: the "secret profile" was one MD5 away - an email hash quietly ties a Gravatar account to the address.

4. Solution

1. from conversation.png: email lambobytelotushotel@gmail.com + "service starting with G" (Gravatar)
2. md5 of the email  (echo -n lambobytelotushotel@gmail.com | md5sum ; or a Node/crypto snippet on OneCompiler)
   -> d4a5fc5d3128890778667e24617d7cc0
3. open https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0?s=80 -> profile -> prize (Base64)
4. base64 -d -> THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}

5. Run it

$ echo VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9 | base64 -d
THM{S3creT_Pr0fil3_H4s_b33n_Ident1fi3d}

6. Summary of how the exploit works