$#forensics

3 writeups

TryHackMeHard09 Aug 2026

Hacker Holidays — Day 14: Management Wants a Word

A KAPE triage image of an abandoned laptop yields one saved Chrome password, decrypted entirely offline through a DPAPI masterkey → Local State → AES-GCM chain, which turns out to be the passphrase for a hidden VeraCrypt volume holding the real evidence.

#hacker-holidays
#forensics
#dpapi
#veracrypt

TryHackMeMedium07 Aug 2026

Hacker Holidays — Day 12: After Hours

Persistence hiding outside every autoruns tool's coverage — a malicious WMI class buried in the raw CIM repository carries a compressed .NET payload that only detonates on the domain controller by name.

#hacker-holidays
#forensics
#wmi-persistence
#dotnet-reversing

Grey hooded mascot holding a laptop with a wifi signal icon

TryHackMeEasy30 Jul 2026

Hacker Holidays — Day 4: Packed Light

A PCAP shows a covert channel exfiltrating one byte per HTTP request inside a Cookie header — base64 plus a single-byte XOR, broken instantly with a known-plaintext crib on the flag format.

#hacker-holidays
#forensics
#network-forensics