Active_2_Lateral_Movement

Author: dree

The attacker moved laterally throughout our domain. I'm hearing reports from other members of wolvctf.corp that 3 lower level accounts were compromised (excluding the 2 higher level compromised accounts). Figure out which ones these are, and follow the attacker's steps to collect the flag.

Users_Backup.zip's password is wolvctf

sha256sum:709b595d63ac9660b9c67de357337ee55ffd6658412b8c5c27b35efc05617893

Flag is split up into 3 parts. https://drive.google.com/drive/folders/11MzaiPYvosPSYlKzqqAVX_muiv5p4yQA?usp=sharing