10 August 2026 · 3 min read · tryhackme

Hacker Holidays Day 14: Management Wants a Word

The last room. You get a KAPE triage collection from the laptop of the guest in Room 214, registered as vera. The job is to find what she hid, recover the password to an encrypted container, and reach the document with the flag. Nothing here lives in one place, so the whole room is about connecting artifacts.

The @0xMia hint sets the direction:

“a browser will remember things for you that you never told anyone else” “why did Patch tell me this version number 1.26.29”

The first line points at saved Chrome passwords. The second is a VeraCrypt version. So the chain is Chrome, DPAPI, vera’s Windows password, then a VeraCrypt container.

The suspicious file

Extracting the archive gives a standard KAPE layout. The thing that stands out is in Documents:

C:\Users\vera\Documents\backup

Around 100 MB, no extension, no readable header. That is either a container, an archive or an encrypted blob, and the version hint already suggests VeraCrypt.

The browser hint makes Chrome the place to start. The history points at a local portal:

Spoiler: the portal it points at

sqlite3 "...\Chrome For Testing\User Data\Default\History" "select url,title from urls;"
# http://bytelotus.thm:8080/   SecureVault Portal

Login Data has one saved credential for it:

Spoiler: the saved login

url:      http://bytelotus.thm:8080/login
username: VeraSecretVault

The password is not plaintext. Chrome protects it with DPAPI, so I needed vera’s Windows crypto material first.

Windows password from the hives

pypykatz reads the password straight out of the registry hives:

Spoiler: the LSA secret

python -m pypykatz registry SYSTEM --sam SAM --security SECURITY --software SOFTWARE
# default_logon_user: vera
# LSA Default Password: minivera

minivera is what derives vera’s DPAPI prekey.

DPAPI to the Chrome password

Generate the prekey for vera’s SID, decrypt the masterkey with it, then decrypt the Chrome logins:

Spoiler: the DPAPI decryption chain

python -m pypykatz dpapi prekey password \
  "S-1-5-21-2529683458-431225740-1723070931-1000" "minivera" -o prekeys.txt

python -m pypykatz dpapi masterkey \
  "...\Protect\S-1-5-21-...-1000\c90719ef-5b98-474e-b934-136d606a702a" \
  prekeys.txt -o masterkeys.txt

python -m pypykatz dpapi chrome \
  masterkeys.txt "...\Chrome For Testing\User Data\Local State" \
  --logindata "...\Chrome For Testing\User Data\Default\Login Data"

Spoiler: the recovered vault password

That gives the saved password: Wh4t1sV3raD0inG0nTh1sH0st. It looks like a portal password, but it also opens the backup file.

Open VeraCrypt

The backup file is the VeraCrypt container the 1.26.29 hint pointed at. Use a VeraCrypt tool to open it with the recovered password (I used the GUI). Inside you should find secret_financial_documents\important_invoice_byte_lotus.pdf, and the flag is the invoice itself. Redacted here.

Afterword

Cool challenges, lower difficulty than HtB’s seasonal for sure, but I like that THM covered foresenics a lot more than HtB’s. Also, the comics and storyline were kind of a small hook for me I guess.

Also, apparently THM hands out raffle tickets for clearing each of the room, which is used at a lucky draw.

I just hope one of them actually wins something.