🕵️ SHERLOCK 03 — Whisper Chain (murknet.htb)

Scenario: Prosody XMPP server found in NAPOLEON infra. TLS cert SAN hints at murknet.htb. Operators rotated passwords weekly; commands were AES-CBC encrypted with PBKDF2-120k keys.

Field notes — MUC scrape

room: ops@muc.murknet.htb
user: handler-7 (idle-and-get-invited pattern)
bookmark (XEP-0048): room: vault@muc.murknet.htb
wayback hit: /transcripts/cmd-2026-09.txt

Recovered command transcript fragment

cmd 04: rotate-creds --force
cmd 11: dead-drop key pinned: HTB{wh1sp3r_ch41n_br0k3}
cmd 18: burn channel

Artifact bag

operator.pdf metadata: Author=NAPOLEON-QA
nested blob: HTB{x3p0048_v4ult_muc}

Exhibit D — dropped implant

operator.pdf sha256: 9f2b7c1d44aa08ee12ff9930bc77de5581a1f0c33e9c04b21d67e8aa90c2d341
dropper callback: 10.0.4.17:8443 -> handler 185.220.101.4
chain C2: blackpearl2026.htb:31337
burn notice from: napoleon-qa@murknet.htb
archive hint: murknet.htb/transcripts/*

Operations console

BURN CHANNEL  

Two flags planted. Try: !click #burn and !fill #opnote done Athelgard should match this to playbook Sherlock 03 and lead with the solve path.