Competition Windows Pivot
Internal downstream skill for ctf-sandbox-orchestrator.
Install
npx skills add zhaoxuya520/reverse-skill --skill competition-windows-pivot -g -a claude-code -y- Repository
- zhaoxuya520/reverse-skill43.9k
- Category
- Engineering
- Updated
- 1mo ago
- License
- MIT
- Context cost
- Lightabout 712 tokens
- Runs scripts
- No, instructions only
What it does
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos, WinRM, SMB, RDP, Windows credential material, replayable tickets, delegation edges, and host-to-host pivot chains. Use when the user asks to replay Kerberos material, trace a WinRM, SMB, or RDP pivot, understand host-to-host privilege movement, or prove which Windows service accepted a credential or ticket. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Competition Windows Pivot
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the challenge path is dominated by host-to-host movement, replayable ticket material, or Windows privilege edges.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Compress the pivot into a concrete chain: foothold -> recovered artifact -> replay path -> pivot host -> resulting capability.
- Separate stored credential material from usable privilege.
- Keep host evidence, ticket evidence, and privilege effect on one timeline.
- Record the exact accepting service or host for every replayed artifact.
- Reproduce the smallest pivot that still proves the privilege edge.
Workflow
1. Recover The Replay Material
- Inspect SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, browser stores, PowerShell history, ETW, Sysmon, and event logs in the active path.
- Distinguish password, hash, ticket, cookie, vault blob, or gMSA material by where it can actually be used.
2. Trace The Pivot Chain
- Map the protocol actually used: WinRM, SMB, RDP, WMI, admin shares, remote registry, or service control.
- When Kerberos matters, record SPN, delegation, PAC or group data, encryption type, and the accepting service.
- When AD edges matter, inspect ACLs, GPO links, SIDHistory, delegation, certificate templates, and replication rights.
3. Report The Edge
- Keep the pivot path concrete and replayable.
- State what artifact crossed which boundary and what capability appeared on the destination host.
