PrintNightmare, thrice!

Walkthrough summary

PrintNightmare, thrice! TryHackMe walkthrough with 10 answered prompts and lab methodology notes.

Sample prompts covered

• What remote address did the employee navigate to?
  Open the walkthrough page to inspect the full answer and command flow.
• Per the PCAP, which user returns a STATUS_LOGON_FAILURE error?
  Open the walkthrough page to inspect the full answer and command flow.
• Which user successfully connects to an SMB share?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the first remote SMB share the endpoint connected to? What was the first filename? What was the second? (format: answer,answer,answer)
  Open the walkthrough page to inspect the full answer and command flow.
• From which remote SMB share was malicious DLL obtained? What was the path to the remote folder for the first DLL? How about the second? (format: answer,answer,answer)
  Open the walkthrough page to inspect the full answer and command flow.