https://tryhackme.com/room/hh-managementwantsaword-6bf3cc41

Author: Harshal P · LinkedIn · TryHackMe

Scenario

🛎️ Concierge Briefing

Housekeeping found a guest's laptop left behind after an early checkout, Room 214, registered to a "Vera." IT pulled a full triage before wiping it for the next guest.

Hunt down the artifacts scattered across her machine and figure out how they fit together. Somewhere in that trail is a password she never meant to leave behind. Follow it, and it'll open a door to something she was keeping very quiet.

🏖️ TODAY'S ITINERARY

• [x] Take a closer look at what she left behind
• [x] Some things aren't as locked away as she thought
• [x] Find out what she was hiding, and claim the flag

Building the investigation mental model

I started with the room briefing before looking at the files. The guest name was Vera. The hint about a browser remembering things and having “a really good memory” instead of a password cracker stood out immediately.

The objective was to recover whatever password Vera left behind in the browser, then use it to open the protected “door” the briefing mentioned. The most likely door was a password protected volume (It was VeraCrypt. I googled the version number and there were definitive hits).

That gave me a working hypothesis I could follow. Chrome saved password → DPAPI recovery → open the volume. Having that locked in stopped me from jumping.

Looking at the triage package

With the hypothesis in place I extracted the triage and started walking the filesystem.

Under the Vera user profile I found the usual AppData, Documents, and NTUSER.DAT (plus the associated log files). Under Windows sat the full set of registry hives — SAM, SYSTEM, SECURITY, SOFTWARE, DEFAULT.