Active_1_Domain_Access

Author: dree

Oh no! Our beloved wolvctf.corp domain has been infiltrated! How did they manage to break into our domain controller? Please figure out how they got access into the domain controller box, how a shell was achieved, and how a domain account was obtained.

We have provided just the user accounts because the attacker did not cover their tracks very well.

Users_Backup.zip's password is wolvctf

sha256sum:709b595d63ac9660b9c67de357337ee55ffd6658412b8c5c27b35efc05617893

Flag is split up into 3 parts. https://drive.google.com/drive/folders/11MzaiPYvosPSYlKzqqAVX_muiv5p4yQA?usp=sharing