The Brochure: when a brochure walks you into Instagram — TryHackMe Hacker Holidays 2026, Day 0

[01] Recon: the image and its silences

First rule with a standalone file: don't trust what you see. I opened the brochure, zoomed in hunting for a watermark, hidden text or odd glyphs. Then I moved to the metadata, because a PNG carries more than it shows.

# scarica l'allegato della room nella cartella corrente (qui rinominato brochure.png)
# parti sempre dai metadati, non dai pixel
exiftool brochure.png
# poi setaccia le stringhe ASCII per qualsiasi cosa social o URL
strings -n 6 brochure.png | grep -iE 'insta|http|thm|flag'
# risultato: niente di embedded — l'indizio vero e' stampato sul volantino

# download the room attachment into the current folder (renamed brochure.png here)
# always start from metadata, not from the pixels
exiftool brochure.png
# then sweep the ASCII strings for anything social or URL-ish
strings -n 6 brochure.png | grep -iE 'insta|http|thm|flag'
# result: nothing embedded — the real hint is printed on the brochure

Clean metadata, clean strings. The truth was in plain sight, printed on the brochure: "Find us on Instagram... or not". That "or not" isn't lazy copywriting: it's a small dare. In OSINT, dares get taken.

[02] SOCMINT: the pivot nobody guards

Here the challenge shows its hand: SOCMINT (Social Media and Username Intelligence). I searched "Byte Lotus" on Instagram and the handle that pops up is thebytelotusresort: two pictures, a bare profile. So far, a marketing account like any other.

The detail that mattered wasn't the posts but the following list: the account followed exactly one other profile, veratheconcierge. A corporate account following a single person is a statistical anomaly: the follow graph is metadata, and here it pointed straight at the next step.

[03] Base64: three posts, one stream

The veratheconcierge account had three posts, each a string of upper- and lower-case letters, numbers and symbols in the post caption: if the text is selectable you copy it straight away, otherwise (if it's baked into the image) you transcribe it by hand, watching 0/O and l/I. Length a multiple of 4, clean alphabet: Base64 at a glance. Verify fragment 1 right away with base64 -d: it must start with THM{.

# tre post = tre blob Base64 (valori mascherati per non spoilerare)
echo -n 'VEhN************' | base64 -d   # frammento 1  -> inizia con THM{
echo -n '████████████████' | base64 -d   # frammento 2 (corpo, oscurato)
echo -n '████████████████' | base64 -d   # frammento 3 (coda + padding '=', oscurato)
# poi concatena nell'ordine giusto (chi dà THM{ è il primo, chi ha == è l'ultimo) e decodifica una volta:
echo -n 'FRAG1FRAG2FRAG3' | base64 -d
# -> THM{████████████████████}

# three posts = three Base64 blobs (values masked to avoid spoilers)
echo -n 'VEhN************' | base64 -d   # fragment 1  -> starts with THM{
echo -n '████████████████' | base64 -d   # fragment 2 (body, redacted)
echo -n '████████████████' | base64 -d   # fragment 3 (tail + '=' padding, redacted)
# then concatenate in the right order (THM{ first, == last) and decode once:
echo -n 'FRAG1FRAG2FRAG3' | base64 -d
# -> THM{████████████████████}

A tinkerer's detail: each post was encoded separately, indistinguishable from one Base64 sliced on 3-byte boundaries. The first two fragments carry no padding (they decode to a multiple of 3 bytes), the third instead carries the ==. That padding isn't decorative: it marks the final piece of the stream. Between that and the continuity of the plaintext (one fragment ends where the next begins), the concatenation order is fixed, no guessing required.

[04] Flag and defensive lesson

I concatenate the three fragments in the right order — the one that decodes to THM{ is first, the one ending in == is last (on the Instagram grid that's chronological order, oldest post to newest) — decode once, and the sentence reassembles itself: the flag comes out clean in the THM{...} format.

THM{████████████████████}

No exploit, no brute force: just a brochure, a follow graph and a trivial encoding. That's the beauty and the danger of OSINT — the chain is made of details that, taken one by one, look harmless.