Hacker Holidays 2026: Day 9: CryptoCabana — Day 10: The Hollow Shell — Day 11: Infinity Pool.

Onix.09

5 min read

·

Jul 30, 2026

--

Listen

Share

Press enter or click to view image in full size

Day 9: CryptoCabana

Task 1: Azure Portal Access

Azure CLI

To solve this challenge, you’ll need the Azure CLI installed on your device. If you’d rather work from your own workstation instead of the provided environment, here’s how to get it set up:

• Windows: Install the Azure CLI on Windows(opens in new tab)
• Linux: Install the Azure CLI on Linux(opens in new tab)
• macOS: Install the Azure CLI on macOS(opens in new tab)

Once installed, verify it’s working with az --version.

Azure CLI via Azure Cloud Shell

Alternatively, you may press the Cloud Details button below to generate your Azure Portal credentials.

Cloud Details

Once done, get the Username (email) and Temporary Access Pass, and log in to the Azure Portal(opens in new tab).

Once logged in, open the Cloud Shell and select Bash.

Press enter or click to view image in full size

Then, select No storage account required and choose Az-Subs-CTF for the subscription.

Press enter or click to view image in full size

Lastly, execute the command below to validate your shell access.

az account show

Press enter or click to view image in full size

You are now ready to solve today’s challenge. Good luck and have fun!

Task 2:☁️ Cloud

🛎️ Concierge Briefing

By the time he made it back from the breakfast buffet, his wallet had already moved on without him. The transaction was signed, properly signed, just not by him.

He’d backed his seed phrase up weeks ago, into the CryptoCabana kiosk’s vault — the one whose landing page promised, in exactly four words, “Backed up. Sleep easy.” Somewhere between that promise and this morning, something else got a good look at what was supposed to stay behind glass.

Your objective: find out what the kiosk is quietly trusting to reach into storage on its own, and see how much further that trust actually extends.

🗝️ ROOM ACCESS

Target

https://cryptocabanaf5scjagc.z13.web.core.windows.net/

🏖️ TODAY’S ITINERARY

Pull apart what the kiosk hands out for free before you’ve even clicked anything.

Follow that trust somewhere the kiosk’s own page never once points you.

Somewhere in there is a second, more valuable set of keys — and a vault that won’t give up the real values on the first ask.

📸 @0xMia’s STORY

@0xMia· posted after breakfast

“the backup kiosk is SO confident. ‘sleep easy’ it says 💀 reader, do not sleep easy. also: if a value looks freshly rotated, ask yourself what it looked like five minutes before that 👀”

CloudAzureStorageKey Vault

Answer the questions below:

Press enter or click to view image in full size

1. Output: THM{n0t_ur

2. Output: _k3ys_n0t_

3. Output: ur_c0lns!}

Press enter or click to view image in full size

What is the flag?

Full Flag: THM{n0t_ur_k3ys_n0t_ur_c01ns!}

Press enter or click to view image in full size

*

Day 10: The Hollow Shell

🛎️ Concierge Briefing

You find it on the beach: pretty, ordinary, the kind of thing nobody thinks to check. Slip something inside and hold it to your ear.

The Byte Lotus beachfront lets guests personalise their in-room display by uploading a shell — a little souvenir pack of shoreline ambiance. Staff publish them through the Shoreline Display portal, and once a shell is “held to the room’s ear” it plays its shore. Slip past what the portal forgets to check, and the shell answers with a shell of your own.

🗝️ ROOM ACCESS

Lab Machine

http://MACHINE_IP

🏖️ TODAY’S ITINERARY

Find the flag

Web

Answer the questions below

Press enter or click to view image in full size

What is the flag?

Flag: THM{z1p_sl1pp3d_1nt0_a_sh3ll}

Press enter or click to view image in full size

Day 11: Infinity Pool

No visible edge. You trace the network to the horizon and find three systems nobody told you about on the other side.

Task 1:

Press enter or click to view image in full size

Task 2: Boot2Root

🛎️ Concierge Briefing

Byte Lotus Hotel promises a seamless stay powered by modern technology. Sometimes the most interesting systems are the ones guests were never meant to see.

🗝️ ROOM ACCESS

Lab Machine

http://MACHINE_IP

🏖️ TODAY’S ITINERARY

Find the user flag

Find the root flag

WebBoot2root

Answer the questions below : —

Press enter or click to view image in full size

What is the user flag?

— THM{n0_v1s1bl3_3dg3}

Press enter or click to view image in full size

What is the root flag?

— THM{tr4c3d_t0_th3_h0r1z0n}

Press enter or click to view image in full size