Skip to main content
Room Icon

After Hours

Bar closed. Guests asleep. Something on the network just clocked in for a shift off the rotation.

medium

60 min

9,060

User profile photo.
User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Hacker Holiday 2026 - Day 12 - After Hours
Source: YouTube

 
 
 
Hacker Holidays ยท The Byte Lotus Hotel
After Hours
  ๐Ÿš  
๐Ÿš
 
 
 
 
 
 
๐ŸŒด
๐ŸŒด
๐Ÿฅฅ
๐Ÿฅฅ
๐Ÿฆ
๐Ÿน
 
Points
90
Category
Forensics
Difficulty
Medium
 
๐Ÿ›Ž๏ธ Concierge Briefing

Long after the front desk closes and the pool lights dim, the resort's back-office machines keep humming. Someone, or something, has been logging in during the small hours, well after the night-shift technician has gone home.

Nothing obvious shows up in Startup, Scheduled Tasks, or the registry Run keys. Whatever's keeping itself alive is hiding somewhere quieter, tucked away in a corner of the system most tools don't think to check.

๐Ÿ—๏ธ ROOM ACCESS
๐Ÿงณ LUGGAGE STORAGE (AttackBox)

Guests working from the AttackBox will find the room's attachments already sitting in the luggage room, no need to check anything in. Head to:

/root/Rooms/hacker-holidays-2026/after-hours

The bellhop's lockbox on that luggage is sealed with the passphrase:

Aft3rH0ursAtt4chm3ntP4ss
๐Ÿ–๏ธ TODAY'S ITINERARY
 Parse the provided system artifacts for hidden custom configuration data
 Locate the malicious class and extract its embedded payload
 Decode the payload and submit the recovered flag
๐Ÿ“ธ @0xMia's STORY
  @0xMia ยท posted 40 min after room unlock

" for anyone stuck rn: the usual autoruns/ tools straight up don't catch this one ๐Ÿ’€ you're gonna have to dig through the raw data by hand #HackerHolidays"

Forensics Windows Persistence Reverse Engineering
Answer the questions below

What is the flag?