competition-identity-windows

Name: competition-identity-windows
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-identity-windows?

zhaoxuya520/reverse-skill/competition-identity-windows

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-identity-windows

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect

Files · 1

View on GitHub

SKILL.md

1	# Competition Identity Windows
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the challenge revolves around identity flow, replayable credentials, Windows host artifacts, enterprise mail, or lateral movement.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Map the identity or pivot chain before diving into every host artifact.
12	2. Separate credential possession from accepted privilege.
13	3. Correlate identity evidence, host evidence, and mail evidence on one timeline.
14	4. Keep tickets, SIDs, event IDs, mailbox rules, and pivot hosts in compact evidence blocks.
15	5. Reproduce the privilege edge or mail effect from the smallest viable chain.
16
17	## Workflow
18
19	### 1. Identity And AD
20
21	- Trace principal origin, sync path, token or ticket minting, claims transformation, group resolution, and accepting service.
22	- When Kerberos matters, record ticket type, SPN, delegation mode, PAC or group data, encryption type, and cache location.
23
24	### 2. Windows Host And Pivoting
25
26	- Correlate SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, ETW, Sysmon, PowerShell, services, tasks, WMI, WinRM, SMB, and RDP as one pivot graph.
27	- Express movement as a concrete chain: foothold -> recovered artifact -> replay path -> pivot host -> resulting capability.
28
29	### 3. Enterprise Messaging
30
31	- Keep phishing lures, consent logs, mailbox rules, and identity-provider events tied together so the mail path and privilege path stay connected.
32
33	## Read This Reference
34
35	- Load `references/identity-windows.md` for the ticket, host, and enterprise-messaging checklist.
36	- If the task is primarily a host-to-host pivot, Kerberos replay, or Windows privilege chain, prefer `$competition-windows-pivot`.
37	- If the task is specifically about constrained delegation, unconstrained delegation, RBCD, S4U, or ticket-acceptance proof, prefer `$competition-kerberos-delegation`.
38	- If the task is specifically about AD CS, certificate templates, EKUs, enrollment rights, PKINIT, or cert-based privilege, prefer `$competition-ad-certificate-abuse`.
39	- If the task is specifically about OAuth or OIDC claims, callback flow, scopes, consent, or accepted login identity, prefer `$competition-oauth-oidc-chain`.
40	- If the task is specifically about DPAPI masterkeys, vault blobs, browser or vault secrets, backup-key use, or protected-secret-to-access chains, prefer `$competition-dpapi-credential-chain`.
41	- If the task is specifically about LSASS memory, ticket caches, LUID-linked material, DPAPI context, or replayable host credential artifacts, prefer `$competition-lsass-ticket-material`.
42	- If the task is specifically about mailbox rules, forwarding, OAuth consent, delegate access, or transport-level mail abuse, prefer `$competition-mailbox-abuse`.
43	- If the task is specifically about forced authentication, relay targets, or proving which service accepts relayed auth, prefer `$competition-relay-coercion-chain`.
44
45	## What To Preserve
46
47	- SIDs, SPNs, ticket fields, event IDs, mailbox rules, and replay points
48	- Exact host-to-host pivot order and the service that accepts the credential or ticket
49	- Raw artifacts, parsed summaries, and derived timelines as separate outputs

People who liked this also viewed

6 picks

Type

competition-identity-windows

8.8kstars1.4kforks

View on GitHub

How to install competition-identity-windows?

zhaoxuya520/reverse-skill/competition-identity-windows

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-identity-windows

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Identity Windows
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the challenge revolves around identity flow, replayable credentials, Windows host artifacts, enterprise mail, or lateral movement.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Map the identity or pivot chain before diving into every host artifact.
12	2. Separate credential possession from accepted privilege.
13	3. Correlate identity evidence, host evidence, and mail evidence on one timeline.
14	4. Keep tickets, SIDs, event IDs, mailbox rules, and pivot hosts in compact evidence blocks.
15	5. Reproduce the privilege edge or mail effect from the smallest viable chain.
16
17	## Workflow
18
19	### 1. Identity And AD
20
21	- Trace principal origin, sync path, token or ticket minting, claims transformation, group resolution, and accepting service.
22	- When Kerberos matters, record ticket type, SPN, delegation mode, PAC or group data, encryption type, and cache location.
23
24	### 2. Windows Host And Pivoting
25
26	- Correlate SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, ETW, Sysmon, PowerShell, services, tasks, WMI, WinRM, SMB, and RDP as one pivot graph.
27	- Express movement as a concrete chain: foothold -> recovered artifact -> replay path -> pivot host -> resulting capability.
28
29	### 3. Enterprise Messaging
30
31	- Keep phishing lures, consent logs, mailbox rules, and identity-provider events tied together so the mail path and privilege path stay connected.
32
33	## Read This Reference
34
35	- Load `references/identity-windows.md` for the ticket, host, and enterprise-messaging checklist.
36	- If the task is primarily a host-to-host pivot, Kerberos replay, or Windows privilege chain, prefer `$competition-windows-pivot`.
37	- If the task is specifically about constrained delegation, unconstrained delegation, RBCD, S4U, or ticket-acceptance proof, prefer `$competition-kerberos-delegation`.
38	- If the task is specifically about AD CS, certificate templates, EKUs, enrollment rights, PKINIT, or cert-based privilege, prefer `$competition-ad-certificate-abuse`.
39	- If the task is specifically about OAuth or OIDC claims, callback flow, scopes, consent, or accepted login identity, prefer `$competition-oauth-oidc-chain`.
40	- If the task is specifically about DPAPI masterkeys, vault blobs, browser or vault secrets, backup-key use, or protected-secret-to-access chains, prefer `$competition-dpapi-credential-chain`.
41	- If the task is specifically about LSASS memory, ticket caches, LUID-linked material, DPAPI context, or replayable host credential artifacts, prefer `$competition-lsass-ticket-material`.
42	- If the task is specifically about mailbox rules, forwarding, OAuth consent, delegate access, or transport-level mail abuse, prefer `$competition-mailbox-abuse`.
43	- If the task is specifically about forced authentication, relay targets, or proving which service accepts relayed auth, prefer `$competition-relay-coercion-chain`.
44
45	## What To Preserve
46
47	- SIDs, SPNs, ticket fields, event IDs, mailbox rules, and replay points
48	- Exact host-to-host pivot order and the service that accepts the credential or ticket
49	- Raw artifacts, parsed summaries, and derived timelines as separate outputs

People who liked this also viewed

6 picks

Type