Volt Typhoon

Walkthrough summary

Volt Typhoon TryHackMe walkthrough with 15 answered prompts and lab methodology notes.

Sample prompts covered

• Comb through the ADSelfService Plus logs to begin retracing the attacker’s steps. At what time (ISO 8601 format) was Dean's password changed and their account taken over by the attacker?
  Open the walkthrough page to inspect the full answer and command flow.
• Shortly after Dean's account was compromised, the attacker created a new administrator account. What is the name of the new account that was created?
  Open the walkthrough page to inspect the full answer and command flow.
• In an information gathering attempt, what command does the attacker run to find information about local drives on server01 & server02?
  Open the walkthrough page to inspect the full answer and command flow.
• The attacker uses ntdsutil to create a copy of the AD database. After moving the file to a web server, the attacker compresses the database. What password does the attacker set on the archive?
  Open the walkthrough page to inspect the full answer and command flow.
• To establish persistence on the compromised server, the attacker created a web shell using base64 encoded text. In which directory was the web shell placed?
  Open the walkthrough page to inspect the full answer and command flow.