HackTheBox Odori is a Medium-difficulty Linux box built around an unusual initial-access vector: rather than a web application or network service bug, the foothold path runs entirely through forensic analysis of a BitLocker-encrypted VMDK disk image retrieved from an anonymously-readable SMB share.
The disk’s protector password is recoverable because it was encrypted without a TPM (a password/recovery-key-only protector), making its hash crackable offline with John the Ripper. Once mounted, offline registry hive parsing (SAM/SECURITY/SYSTEM) surfaces a service account, and DPAPI-protected credential blobs under the SYSTEM profile hold that account’s plaintext password but DPAPI decryption requires a live Windows session, so the disk’s local Administrator password is reset offline with chntpw, the VM is booted, and Mimikatz extracts the DPAPI master key from LSASS to decrypt the credential file.
That recovered password (svc_backup) authenticates over SSH to the real target box, but the account is locked into a ForceCommand-restricted SFTP-only shell ; a restriction bypassed by overwriting the writable wrapper script that SSH invokes, turning the forced SFTP session into an interactive bash shell.
Privilege escalation abuses a world-writable __pycache__ directory: a root-run cron job imports a Python module whose compiled .pyc bytecode cache can be edited in place to redirect a hardcoded tar binary path to an attacker-controlled script, which sets the SUID bit on /bin/bash once triggered.
Complete writeup below: