Competition Identity Windows
Internal downstream skill for ctf-sandbox-orchestrator.
Install
npx skills add zhaoxuya520/reverse-skill --skill competition-identity-windows -g -a claude-code -y- Repository
- zhaoxuya520/reverse-skill43.9k
- Category
- Engineering
- Updated
- 1mo ago
- License
- MIT
- Context cost
- Lightabout 853 tokens
- Runs scripts
- No, instructions only
What it does
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Active Directory, Kerberos, LDAP, OAuth, enterprise messaging, Windows host forensics, credential material, and lateral-movement challenges. Use when the user asks to trace tickets or tokens, inspect mailbox rules, analyze Windows host evidence, understand an AD trust path, or explain a lateral-movement chain across sandbox-linked nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Competition Identity Windows
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the challenge revolves around identity flow, replayable credentials, Windows host artifacts, enterprise mail, or lateral movement.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Map the identity or pivot chain before diving into every host artifact.
- Separate credential possession from accepted privilege.
- Correlate identity evidence, host evidence, and mail evidence on one timeline.
- Keep tickets, SIDs, event IDs, mailbox rules, and pivot hosts in compact evidence blocks.
- Reproduce the privilege edge or mail effect from the smallest viable chain.
Workflow
1. Identity And AD
- Trace principal origin, sync path, token or ticket minting, claims transformation, group resolution, and accepting service.
- When Kerberos matters, record ticket type, SPN, delegation mode, PAC or group data, encryption type, and cache location.
2. Windows Host And Pivoting
- Correlate SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, ETW, Sysmon, PowerShell, services, tasks, WMI, WinRM, SMB, and RDP as one pivot graph.
- Express movement as a concrete chain: foothold -> recovered artifact -> replay path -> pivot host -> resulting capability.
3. Enterprise Messaging
- Keep phishing lures, consent logs, mailbox rules, and identity-provider events tied together so the mail path and privilege path stay connected.
