Scripts and Formulas

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

After the last site UNZ used to rely on for the majority of Vitalium mining ran dry, the UNZ hired a local geologist to examine possible sites that were used in the past for secondary mining operations. However, after finishing the examinations, and the geologist was ready to hand in his reports, he mysteriously went missing! After months, a mysterious invoice regarding his examinations was brought up to the Department. Being new to the job, the clerk wasn't aware of the past situation and opened the Invoice. Now all of a sudden, the Arodor faction is really close to taking the lead on Vitalium mining! Given some Logs from the Clerk's Computer and the Invoice, pinpoint the intrusion methods used and how the Arodor faction gained access!

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. In this challenge we're given few windows event log file, a .lnk file, and a visual basic script file.
2. Checking the properties for .lnk file, it used to create an .exe shortcut.

1ST QUESTION --> ANS: REDACTED

1. To answer this question, I started by analyzing the Windows Powershell event log.

2. Noticed, there's a cp command which indicate a copy attempt.

3. It seems the attacker attempts to copy a file named cscript.exe to another file named calc.exe.

2ND QUESTION --> ANS:

REDACTED

1. At this function, it runs a loop operation which make it interesting, but we can't decode it.

2. That function also called by the other function.

3. Hence, I started to analyze the Microsoft-Windows-PowerShell/Operational event log.

4. Upon analyzing it, found an encoded base64 strings, which resulting to a spreadsheet link after decoding it. Sadly the API key is no longer valid.

5. Here we can see what command was executed.

6. Scrolling down, we can identified the obfuscation is done in a for loop and it runs some XOR operation.

3RD QUESTION --> ANS: REDACTED

4TH QUESTION --> ANS:

REDACTED

5TH QUESTION --> ANS: REDACTED

6TH QUESTION --> ANS: REDACTED

1. Checking the eventID column at the event log shall let us get the ans.

7TH QUESTION --> ANS: REDACTED

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.