AOC 25 Days 14-18: Docker, Web DFIR, & Registry Hives

Escape Docker containers via UNIX sockets, triage Apache web attacks in Splunk, parse Windows registry hives, solve CyberChef locks, and deobfuscate C2 scripts.

This technical write-up covers Days 14 through 18 of the TryHackMe Advent of Cyber 2025 event: Containers - DoorDasher's Demise, Web Attack Forensics - Drone Alone, Forensics - Registry Furensics, CyberChef - Hoperation Save McSkidy, and Obfuscation - The Egg Shell File.

Across these five operational exercises, we investigate container breakouts via expo…