一键在 Manus 中运行任何 Skill

competition-kerberos-delegation

星标8,362

分支1,314

更新时间2026年5月24日 11:23

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges, S4U abuse, RBCD, constrained or unconstrained delegation, and service-ticket acceptance. Use when the user asks about constrained delegation, unconstrained delegation, RBCD, S4U, SPNs, ticket acceptance, or how a Kerberos trust edge turns into effective privilege under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

zhaoxuya520

zhaoxuya520/reverse-skill

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Competition Kerberos Delegation

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the hard part is not "is there Kerberos here," but which delegation edge exists, which ticket is being minted, and which service really accepts it.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Write the trust chain first: principal -> delegation edge -> ticket type -> target SPN -> accepting service -> resulting privilege.
Separate ticket possession from accepted privilege.
Keep SPNs, delegation mode, PAC/group data, encryption type, and service acceptance in one compact evidence block.
Reproduce one minimal delegation chain before broadening into variants.
Tie every privilege claim to a specific accepted ticket or service-side effect.

Workflow

1. Identify The Delegation Edge

Determine whether the path is constrained delegation, unconstrained delegation, resource-based constrained delegation, protocol transition, or another trust edge.
Inspect SPNs, ACLs, service accounts, SIDHistory, certificate templates, and replication rights only when they affect the active path.

2. Trace Ticket Minting And Acceptance

Record TGT/TGS type, S4U steps when relevant, delegation flags, PAC or group data, encryption type, cache location, and target SPN.
Prove which service actually accepts the ticket and what capability appears after acceptance.

3. Report The Effective Edge

Compress the chain into one replayable path, not a vague "domain compromise" statement.
Separate candidate edges from the edge that really lands privilege.

Read This Reference

Load references/kerberos-delegation.md for the delegation checklist, ticket fields to preserve, and common proof mistakes.

What To Preserve

SPN, ticket type, delegation mode, PAC/group data, encryption type, cache location, accepting service
Service-side logs, event IDs, logon session changes, or group changes proving effective privilege
The exact trust edge that makes the ticket replayable

同仓库更多 Skills

同仓库

pentest-tools

zhaoxuya520/reverse-skill

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

2026-07-108.4k

reverse-engineering

zhaoxuya520/reverse-skill

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

2026-07-058.4k

apk-reverse

zhaoxuya520/reverse-skill

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

2026-07-038.4k

binary-diff

zhaoxuya520/reverse-skill

跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。

2026-07-038.4k

diagram-generator

zhaoxuya520/reverse-skill

generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.

2026-07-038.4k

edr-bypass-re

zhaoxuya520/reverse-skill

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来，再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective DLL。

2026-07-038.4k

name

competition-kerberos-delegation

description

Competition Kerberos Delegation

Use this skill when the hard part is not "is there Kerberos here," but which delegation edge exists, which ticket is being minted, and which service really accepts it.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Write the trust chain first: principal -> delegation edge -> ticket type -> target SPN -> accepting service -> resulting privilege.
Separate ticket possession from accepted privilege.
Keep SPNs, delegation mode, PAC/group data, encryption type, and service acceptance in one compact evidence block.
Reproduce one minimal delegation chain before broadening into variants.
Tie every privilege claim to a specific accepted ticket or service-side effect.

Workflow

1. Identify The Delegation Edge

Determine whether the path is constrained delegation, unconstrained delegation, resource-based constrained delegation, protocol transition, or another trust edge.
Inspect SPNs, ACLs, service accounts, SIDHistory, certificate templates, and replication rights only when they affect the active path.

2. Trace Ticket Minting And Acceptance

Record TGT/TGS type, S4U steps when relevant, delegation flags, PAC or group data, encryption type, cache location, and target SPN.
Prove which service actually accepts the ticket and what capability appears after acceptance.

3. Report The Effective Edge

Compress the chain into one replayable path, not a vague "domain compromise" statement.
Separate candidate edges from the edge that really lands privilege.

Read This Reference

Load references/kerberos-delegation.md for the delegation checklist, ticket fields to preserve, and common proof mistakes.

What To Preserve

SPN, ticket type, delegation mode, PAC/group data, encryption type, cache location, accepting service
Service-side logs, event IDs, logon session changes, or group changes proving effective privilege
The exact trust edge that makes the ticket replayable