Skip to main content
Room Icon

After Hours

Bar closed. Guests asleep. Something on the network just clocked in for a shift off the rotation.

medium

60 min

242

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

 
 
 
Hacker Holidays · The Byte Lotus Hotel
After Hours
  🐚  
🐚
 
 
 
 
 
 
🌴
🌴
🥥
🥥
🍦
🍹
 
Points
90
Category
Forensics
Difficulty
Medium
 
🛎️ Concierge Briefing

Long after the front desk closes and the pool lights dim, the resort's back-office machines keep humming. Someone, or something, has been logging in during the small hours, well after the night-shift technician has gone home.

Nothing obvious shows up in Startup, Scheduled Tasks, or the registry Run keys. Whatever's keeping itself alive is hiding somewhere quieter, tucked away in a corner of the system most tools don't think to check.

🗝️ ROOM ACCESS
🧳 LUGGAGE STORAGE (AttackBox)

Guests working from the AttackBox will find the room's attachments already sitting in the luggage room, no need to check anything in. Head to:

/root/Rooms/hacker-holidays-2026/after-hours

The bellhop's lockbox on that luggage is sealed with the passphrase:

Aft3rH0ursAtt4chm3ntP4ss
🏖️ TODAY'S ITINERARY
 Parse the provided system artifacts for hidden custom configuration data
 Locate the malicious class and extract its embedded payload
 Decode the payload and submit the recovered flag
📸 @0xMia's STORY
  @0xMia · posted 40 min after room unlock

" for anyone stuck rn: the usual autoruns/ tools straight up don't catch this one 💀 you're gonna have to dig through the raw data by hand #HackerHolidays"

Forensics Windows Reverse Engineering
Answer the questions below

What is the flag?