Jinkies a HTB Writeup

August 2, 2026 - 4 mins read

This writeup documents my analysis of the Jinkies sherlock on HackTheBox. In this challenge we are given a kape image of a compromised machine. Let’s analyze the attack happened… Which folders were shared on the host? (Please give your answer comma separated, like this: c:\program files\share1, D:\folder\share2) To inspect which folders were shared on the network we can simply refer to this path HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares on the SYSTEM registry hive. Inspecting the above path in Registry Explorer i found two paths that are shared C:\Users, C:\Users\Velma\Documents.

Recollection a HTB Writeup

July 26, 2026 - 5 mins read

This writeup documents my analysis of the Recollection sherlock on HackTheBox. In this challenge we are given a memory dump of a machine suspected to be compromised. Let’s analyze it… What is the Operating System of the machine? Utilizing Volatility3 for working with the memory dump, we can use windows.info to get the answer. Running python3 vol.py -f '/recollection.bin' windows.info we can tell from the buildLab value that the memory image was taken from a Windows 7 machine.

RogueOne a HTB Writeup

July 24, 2026 - 3 mins read

This writeup documents my analysis of the RogueOne sherlock on Hackthebox. In this challenge we are given a memory dump of a machine suspected to be compromised. Let’s analyze it… Please identify the malicious process and confirm the process ID of the malicious process. Parsing the memory dump using volatility3’s windows.cmdline, a conspicuous process immediately stands out. svchost.exe is a core Windows process that enables running background services from DLL files and typically lives in “C:\WINDOWS\system32\svchost.

Trent Sherlock a Hack The Box Writeup

February 14, 2026 - 4 mins read

This writeup documents my analysis and investigation of the Trent sherlock on Hackthebox. The challenge involves the analysis of a compromised router. Where the attacker gained unauthorized access to the router’s web administration interface, exploited a known vulnerability to achieve remote code execution (RCE), and ultimately established a reverse shell connection to an external command-and-control server. We are provided with a trent.pcap file that includes communication between the attacker and the compromised router.

Bumblebee a HTB Writeup

February 13, 2026 - 2 mins read

This writeup documents my analysis of the Bumblebee sherlock on Hackthebox. Let’s get into it… What was the username of the external contractor? Inspecting the supplied database file in an SQL DB viewer, specifically the users table, I identified two accounts related to the contractor, of which apoole1 is the answer. What IP address did the contractor use to create their account? In the same table from the previous question, the user’s IP is 10.

Holmes 2: The Watchmen residue a HTB Writeup

February 12, 2026 - 7 mins read

This writeup documents my analysis and investigation of the Holmes 2025 2: The Watchmen residue sherlock on Hackthebox. Let’s get into it… What was the IP address of the decommissioned machine used by the attacker to start a chat session with MSP-HELPDESK-AI? In this box we were provided with a pcap file that records requests between the exploited chat service and a few clients one of which is the malicious actor.

Allegretto a HTB Writeup

February 8, 2026 - 5 mins read

This writeup documents my analysis and investigation of the Allegretto sherlock on Hackthebox. This sherlock focuses heavily on filesystem forensics, email artifacts, browser data, and document metadata. Let’s get into it… Which version of QGIS is being used by Shadow? To identify installed applications, the Master file table ($MFT) was parsed using MFTECmd: MFTECmd.exe -f ...\Allegretto\Target\C\$MFT --csv . Searching the output CSV for QGIS revealed the following entry: 589,5,True,334831,1,.\Program Files\QGIS 3.

Suspicious Python Package LetsDefend Writeup

January 26, 2026 - 4 mins read

This writeup documents my analysis and investigation of the Suspicious Python Package challenge on LetsDefend. As you can guess the objective was to investigate a malicious python package. Let’s get into it… The attacker downloaded a malicious package. What is the full URL? First i assumed the package was downloaded using Chrome instead of Pip. So i looked into the chrome History SQLite db file. Which is located at *“C\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\History”*This file holds various information regarding downloads made on chrome.

Wordpress Web Forensics LetsDefend Writeup

January 24, 2026 - 4 mins read

This writeup documents my analysis and investigation of the WordPress Web Forensics challenge on LetsDefend. The objective was to investigate a wordpress server breach using the web server logs and Splunk. After setting up the provided log source let’s dive in.. What is the attacker’s IP address from which the WPScan enumeration originated? “WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites”

Spymax Telegram Rat LetsDefend Writeup

January 23, 2026 - 4 mins read

This write‑up documents how I approached and solved the SpyMax Telegram RAT challenge on LetsDefend. The scenario involves a victim who attempted to download the Telegram app on their Android device. Instead of using the official Google Play Store, the victim accessed a suspicious website advertising a “faster” download. The victim installed a malicious APK disguised as Telegram, resulting in a potential device compromise. The objective of this investigation was to analyze the APK and uncover key details about the attack.