Hacker Holidays — Day 6: Overheard at Breakfast

Event: Hacker Holidays — The Byte Lotus Hotel · Day 6 · OSINT (Social Media / Hashing) File: conversation.png

The Setup

A screenshotted chat between Ponzi and Lambo. The task: read the conversation, extract identifying details, and pivot into a “hidden account nobody was supposed to find.” Tags: Social Media + Hashing — the hashing is the twist.

Rule Out the File First

The image itself is clean — no need to chase stego:

exiftool conversation.png      # nothing but standard PNG tags
strings conversation.png | grep -iE 'thm|http|@|md5|flag'   # nothing
binwalk conversation.png       # just the PNG's own zlib stream
file conversation.png          # legit PNG, RGBA

So the answer is entirely in what the conversation says — matching @0xMia’s hint: “actually READ what they said, not just skim it.”

Chat between Ponzi and Lambo, Lambo mentions a "free tool starting with G" and shares his email

The Clues in the Dialogue

Lambo says he doesn’t use social media much anymore, but:

“I used to use this free tool that let me upload my profile and link other media accounts… Started with a G if I remember correctly.” “this is my best way of communication: lambobytelotushotel@gmail.com”

Decode the riddle:

A free service hosting a profile that links your other accounts, keyed to an email, starting with G → Gravatar.
Gravatar profiles are addressed by the MD5 of the (lowercased, trimmed) email → that’s the Hashing tag.

Exploitation

Hash the email:

echo -n "lambobytelotushotel@gmail.com" | md5sum
# d4a5fc5d3128890778667e24617d7cc0

Fetch the Gravatar profile JSON by that hash:

curl -s "https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json" | jq

{
  "entry": [{
    "profileUrl": "https://gravatar.com/cheerfullysongf28e3c3716",
    "preferredUsername": "cheerfullysongf28e3c3716",
    "displayName": "Lambo",
    "currentLocation": "Byte Lotus Hotel",
    "aboutMe": "Funny thing about email hashes, they follow you places you didn't expect. Glad you found the right corner of the internet! Here is your prize: VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9"
  }]
}

The prize in aboutMe is base64:

echo "VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWZpM2R9" | base64 -d
# THM{redacted}

Takeaways

Gravatar is an OSINT goldmine. Anyone who knows an email can compute md5(email) and pull the associated Gravatar profile — display name, location, bio, and every linked/verified account. No login, no consent.
Email hashes are not anonymisation. MD5 of an email is a stable, guessable identifier — “they follow you places you didn’t expect.” Reusing the same email across a throwaway and a real profile links them permanently.
OSINT lesson: read, don’t skim. No tool cracked this — the whole solve was one carefully-read sentence (“free tool… starts with G”) plus the email in plain sight.
The .json (and .vcf, .xml) profile endpoints return more structured data than the HTML page — always pull those.

Flag

THM{redacted}

The Setup#

Rule Out the File First#

The Clues in the Dialogue#

Exploitation#

Takeaways#

Flag#