synacktiv/lehack-2026-challengeSources of Synacktiv's challenge for leHack 2026
A 3-tier challenge demonstrating impact of direct disk mounting.
| Level | Goal | Technique |
|---|---|---|
| 1 | Access the unencrypted disk | Set boot cmdline to init=/bin/bash in grub |
| 2 | Crack vault1 LUKS | Extract header → hashcat → unlock & mount vault |
| 3 | Crack vault2 LUKS | Read the key from the TPM |
| User | Password |
|---|---|
root | SynacktivSekurPasswd1337! |
operator | donthackmeplsss |
| LUKS vault 1 | ihatehackers! |
Tested with Libvirt + QEMU and an emulated TIS TPM 2.0.
The challenge can be easily deployed remotely from an any linux distro with the nix package manager:
# Enter the development shell to get the development dependencies
nix develop
# Deploy the challenge to a remote machine
# Vda is the disk type, use nvme or sda depending on disk type
just anywhere <vm-ip> vda
Once the challenge has been deployed on the remote machine, you should execute the /root/setup-vault.sh script to setup the vaults.
See WRITEUP.md for a complete writeup of the challenge.