competition-lsass-ticket-material

Name: competition-lsass-ticket-material
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-lsass-ticket-material?

zhaoxuya520/reverse-skill/competition-lsass-ticket-material

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-lsass-ticket-material

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction. Use when the user asks to inspect LSASS memory, rec

Files · 1

View on GitHub

SKILL.md

1	# Competition LSASS Ticket Material
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive host artifact lives in LSASS, ticket caches, or adjacent credential material and the hard part is proving what is replayable.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Separate raw credential material from actually usable replay edges.
12	2. Record logon session, LUID, ticket cache, package, account, and target service before broad conclusions.
13	3. Keep host artifact, extracted secret, replay attempt, and resulting acceptance in one chain.
14	4. Distinguish password, hash, ticket, DPAPI secret, SSP residue, and token by where each can actually be used.
15	5. Reproduce the smallest host-artifact-to-accepted-privilege path that proves the decisive edge.
16
17	## Workflow
18
19	### 1. Map LSASS And Adjacent Credential State
20
21	- Record logon sessions, LUIDs, ticket caches, package names, SSPs, DPAPI context, and any service-account material tied to the active path.
22	- Note whether the decisive value is a TGT, service ticket, delegated ticket, DPAPI secret, plaintext, hash, or package-specific secret.
23	- Keep host source, account context, and cache location tied together.
24
25	### 2. Prove Replay Or Acceptance
26
27	- Show where the extracted material is accepted: SMB, WinRM, service ticket use, DPAPI unwrap, Schannel, or another host or service edge.
28	- Record SPN, target host, logon session, ticket flags, encryption type, and resulting privilege or token change.
29	- Distinguish material that is present from material that is actually replayable in this path.
30
31	### 3. Reduce To The Decisive Credential Chain
32
33	- Compress the result to the smallest sequence: host artifact -> extracted material -> accepted replay or unwrap -> resulting capability.
34	- State clearly whether the decisive edge lives in LSASS memory, ticket cache reuse, DPAPI context, or accepting service behavior.
35	- If the task broadens into full host-to-host pivoting, hand back to the tighter Windows pivot skill.
36
37	## Read This Reference
38
39	- Load `references/lsass-ticket-material.md` for the session checklist, replay checklist, and evidence packaging.
40	- If the task is specifically about DPAPI masterkeys, protected blobs, browser or vault stores, or proving which recovered DPAPI secret is accepted, prefer `$competition-dpapi-credential-chain`.
41
42	## What To Preserve
43
44	- LUIDs, session IDs, ticket types, SPNs, encryption types, package names, and cache or memory source
45	- The exact accepting host or service and the resulting privilege or logon effect
46	- One minimal host-artifact-to-replay sequence that proves the edge

People who liked this also viewed

6 picks

Type

competition-lsass-ticket-material

8.8kstars1.4kforks

View on GitHub

How to install competition-lsass-ticket-material?

zhaoxuya520/reverse-skill/competition-lsass-ticket-material

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-lsass-ticket-material

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition LSASS Ticket Material
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive host artifact lives in LSASS, ticket caches, or adjacent credential material and the hard part is proving what is replayable.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Separate raw credential material from actually usable replay edges.
12	2. Record logon session, LUID, ticket cache, package, account, and target service before broad conclusions.
13	3. Keep host artifact, extracted secret, replay attempt, and resulting acceptance in one chain.
14	4. Distinguish password, hash, ticket, DPAPI secret, SSP residue, and token by where each can actually be used.
15	5. Reproduce the smallest host-artifact-to-accepted-privilege path that proves the decisive edge.
16
17	## Workflow
18
19	### 1. Map LSASS And Adjacent Credential State
20
21	- Record logon sessions, LUIDs, ticket caches, package names, SSPs, DPAPI context, and any service-account material tied to the active path.
22	- Note whether the decisive value is a TGT, service ticket, delegated ticket, DPAPI secret, plaintext, hash, or package-specific secret.
23	- Keep host source, account context, and cache location tied together.
24
25	### 2. Prove Replay Or Acceptance
26
27	- Show where the extracted material is accepted: SMB, WinRM, service ticket use, DPAPI unwrap, Schannel, or another host or service edge.
28	- Record SPN, target host, logon session, ticket flags, encryption type, and resulting privilege or token change.
29	- Distinguish material that is present from material that is actually replayable in this path.
30
31	### 3. Reduce To The Decisive Credential Chain
32
33	- Compress the result to the smallest sequence: host artifact -> extracted material -> accepted replay or unwrap -> resulting capability.
34	- State clearly whether the decisive edge lives in LSASS memory, ticket cache reuse, DPAPI context, or accepting service behavior.
35	- If the task broadens into full host-to-host pivoting, hand back to the tighter Windows pivot skill.
36
37	## Read This Reference
38
39	- Load `references/lsass-ticket-material.md` for the session checklist, replay checklist, and evidence packaging.
40	- If the task is specifically about DPAPI masterkeys, protected blobs, browser or vault stores, or proving which recovered DPAPI secret is accepted, prefer `$competition-dpapi-credential-chain`.
41
42	## What To Preserve
43
44	- LUIDs, session IDs, ticket types, SPNs, encryption types, package names, and cache or memory source
45	- The exact accepting host or service and the resulting privilege or logon effect
46	- One minimal host-artifact-to-replay sequence that proves the edge

People who liked this also viewed

6 picks

Type