Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
vault.json is generated from the FLAG injected at startup. Brute-force the 0000–9999 PIN SHA-256 and XOR-decrypt with the matching stream to recover the flag.
Inspect vault.json and identify the target record
brute-force the 0000–9999 PIN SHA-256 and XOR-decrypt with the matching stream
Verify that the reconstructed value has FLAG{...} format