/docs/hackthebox/Recent content in HackTheBox on Eddak Inc.HugoenCopyright (c) 2020-2024 ThuliteWed, 15 Jul 2026 08:00:00 +0200/docs/hackthebox/htb-sherlock-crownjewel-2/Mon, 01 Jun 2026 08:04:48 +0200/docs/hackthebox/htb-sherlock-crownjewel-2/Walking the CrownJewel-2 Sherlock: tracing an ntdsutil.exe NTDS dump through System, Application (ESENT), and Security logs to rebuild the attacker’s timeline./docs/hackthebox/htb-sherlock-phantomring/Wed, 15 Jul 2026 08:00:00 +0200/docs/hackthebox/htb-sherlock-phantomring/Walking the PhantomRing Sherlock: pulling C2 config, the command protocol, and anti-EDR tricks (io_uring syscall evasion, ftrace/eBPF killing, self-destruct) out of a Linux malware sample in Ghidra.