competition-windows-pivot

Name: competition-windows-pivot
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-windows-pivot?

zhaoxuya520/reverse-skill/competition-windows-pivot

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-windows-pivot

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or

Files · 1

View on GitHub

SKILL.md

1	# Competition Windows Pivot
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the challenge path is dominated by host-to-host movement, replayable ticket material, or Windows privilege edges.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Compress the pivot into a concrete chain: foothold -> recovered artifact -> replay path -> pivot host -> resulting capability.
12	2. Separate stored credential material from usable privilege.
13	3. Keep host evidence, ticket evidence, and privilege effect on one timeline.
14	4. Record the exact accepting service or host for every replayed artifact.
15	5. Reproduce the smallest pivot that still proves the privilege edge.
16
17	## Workflow
18
19	### 1. Recover The Replay Material
20
21	- Inspect SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, browser stores, PowerShell history, ETW, Sysmon, and event logs in the active path.
22	- Distinguish password, hash, ticket, cookie, vault blob, or gMSA material by where it can actually be used.
23
24	### 2. Trace The Pivot Chain
25
26	- Map the protocol actually used: WinRM, SMB, RDP, WMI, admin shares, remote registry, or service control.
27	- When Kerberos matters, record SPN, delegation, PAC or group data, encryption type, and the accepting service.
28	- When AD edges matter, inspect ACLs, GPO links, SIDHistory, delegation, certificate templates, and replication rights.
29
30	### 3. Report The Edge
31
32	- Keep the pivot path concrete and replayable.
33	- State what artifact crossed which boundary and what capability appeared on the destination host.
34
35	## Read This Reference
36
37	- Load `references/windows-pivot.md` for the pivot checklist, Kerberos evidence block, and common replay mistakes.
38	- If the task is specifically about DPAPI masterkeys, browser or vault stores, protected blobs, or proving where a recovered DPAPI secret is accepted, prefer `$competition-dpapi-credential-chain`.
39	- If the task is specifically about LSASS memory, ticket caches, replayable session material, or host-resident credential extraction, prefer `$competition-lsass-ticket-material`.
40	- If the task is specifically about delegation edges, SPN trust, S4U flow, or which service accepts the delegated ticket, prefer `$competition-kerberos-delegation`.
41	- If the hard part is forced authentication, coercion primitives, relay targets, or the service that accepts relayed auth, prefer `$competition-relay-coercion-chain`.
42
43	## What To Preserve
44
45	- Host names, logon IDs, SIDs, SPNs, ticket fields, service names, and event IDs
46	- Exact replay point and resulting logon session, token, or group change
47	- Raw host artifacts and derived timeline separately

People who liked this also viewed

6 picks

Type

competition-windows-pivot

8.8kstars1.4kforks

View on GitHub

How to install competition-windows-pivot?

zhaoxuya520/reverse-skill/competition-windows-pivot

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-windows-pivot

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Windows Pivot
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the challenge path is dominated by host-to-host movement, replayable ticket material, or Windows privilege edges.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Compress the pivot into a concrete chain: foothold -> recovered artifact -> replay path -> pivot host -> resulting capability.
12	2. Separate stored credential material from usable privilege.
13	3. Keep host evidence, ticket evidence, and privilege effect on one timeline.
14	4. Record the exact accepting service or host for every replayed artifact.
15	5. Reproduce the smallest pivot that still proves the privilege edge.
16
17	## Workflow
18
19	### 1. Recover The Replay Material
20
21	- Inspect SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, browser stores, PowerShell history, ETW, Sysmon, and event logs in the active path.
22	- Distinguish password, hash, ticket, cookie, vault blob, or gMSA material by where it can actually be used.
23
24	### 2. Trace The Pivot Chain
25
26	- Map the protocol actually used: WinRM, SMB, RDP, WMI, admin shares, remote registry, or service control.
27	- When Kerberos matters, record SPN, delegation, PAC or group data, encryption type, and the accepting service.
28	- When AD edges matter, inspect ACLs, GPO links, SIDHistory, delegation, certificate templates, and replication rights.
29
30	### 3. Report The Edge
31
32	- Keep the pivot path concrete and replayable.
33	- State what artifact crossed which boundary and what capability appeared on the destination host.
34
35	## Read This Reference
36
37	- Load `references/windows-pivot.md` for the pivot checklist, Kerberos evidence block, and common replay mistakes.
38	- If the task is specifically about DPAPI masterkeys, browser or vault stores, protected blobs, or proving where a recovered DPAPI secret is accepted, prefer `$competition-dpapi-credential-chain`.
39	- If the task is specifically about LSASS memory, ticket caches, replayable session material, or host-resident credential extraction, prefer `$competition-lsass-ticket-material`.
40	- If the task is specifically about delegation edges, SPN trust, S4U flow, or which service accepts the delegated ticket, prefer `$competition-kerberos-delegation`.
41	- If the hard part is forced authentication, coercion primitives, relay targets, or the service that accepts relayed auth, prefer `$competition-relay-coercion-chain`.
42
43	## What To Preserve
44
45	- Host names, logon IDs, SIDs, SPNs, ticket fields, service names, and event IDs
46	- Exact replay point and resulting logon session, token, or group change
47	- Raw host artifacts and derived timeline separately

People who liked this also viewed

6 picks

Type