一键在 Manus 中运行任何 Skill

competition-linux-credential-pivot

星标8,362

分支1,314

更新时间2026年5月24日 11:23

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust, and host-to-host pivot chains. Use when the user asks to trace Linux auth artifacts, accepted token or key replay, socket or service-account trust edges, sudo or capability abuse, or explain lateral movement across Linux challenge nodes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

zhaoxuya520

zhaoxuya520/reverse-skill

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Competition Linux Credential Pivot

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the decisive edge is Linux credential material and where that material is accepted.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Separate credential storage from accepted privilege.
Record user, process, namespace, socket, key file, and service trust boundary before conclusions.
Keep artifact recovery, replay path, and resulting capability in one chain.
Distinguish local escalation from lateral host pivot.
Reproduce one minimal artifact-to-accepted-access path.

Workflow

1. Map Credential And Trust Artifacts

Record SSH keys, agent sockets, kubeconfigs, cloud tokens, service-account secrets, env vars, config files, and process memory clues.
Note sudoers rules, capabilities, setuid binaries, systemd unit context, and namespace boundaries.
Keep each artifact tied to owner, scope, and expected accepting service.

2. Prove Replay And Pivot

Show where key, token, socket, or secret is accepted: SSH, API, Unix socket, container runtime, or control-plane endpoint.
Record host target, protocol, principal, and resulting session or privilege.
Distinguish authentication success from useful capability gain.

3. Reduce To Decisive Linux Pivot Chain

Compress to: recovered artifact -> accepted replay path -> pivot host or privilege transition -> resulting capability.
State whether root cause is weak key handling, token leakage, socket trust, sudo or capability abuse, or namespace crossover.
If the chain pivots into kernel exploit boundaries, hand off to kernel container escape skill.

Read This Reference

Load references/linux-credential-pivot.md for artifact checklists, replay matrix, and evidence packaging.

What To Preserve

Artifact path, owner, scope, accepting service, and resulting principal
Exact pivot order with protocol and target host or namespace
One minimal replayable chain proving capability gain

同仓库更多 Skills

同仓库

pentest-tools

zhaoxuya520/reverse-skill

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

2026-07-108.4k

reverse-engineering

zhaoxuya520/reverse-skill

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

2026-07-058.4k

apk-reverse

zhaoxuya520/reverse-skill

在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。

2026-07-038.4k

binary-diff

zhaoxuya520/reverse-skill

跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。

2026-07-038.4k

diagram-generator

zhaoxuya520/reverse-skill

generate, refine, validate, and render diagrams from natural language, notes, code snippets, schemas, tables, or existing diagram source. use for flowcharts, swimlanes, sequence diagrams, state diagrams, er diagrams, class diagrams, architecture/c4-style diagrams, dependency graphs, gantt charts, mind maps, user journeys, sankey-style flows, org charts, network graphs, and other visual models. supports mermaid by default, graphviz dot for complex graph layout, plantuml for uml-heavy engineering diagrams, and svg output when direct markup is more reliable.

2026-07-038.4k

edr-bypass-re

zhaoxuya520/reverse-skill

逆向防御方实现 → 红队针对性绕过。把 EDR / Defender / AV 的 hook 表、ETW provider、AMSI 实现先逆向出来，再写针对性的 unhook / 间接 syscall / ETW patch / call stack spoof。对照 MITRE ATT&CK T1562 防御规避。触发关键词：EDR 绕过、AV bypass、免杀、unhook、direct syscall、indirect syscall、Hell's Gate、Halo's Gate、 Tartarus Gate、ETW patch、AMSI patch、call stack spoofing、hardware breakpoint Blindside、MITRE T1562、 ntdll unhook、kernel callback、CrowdStrike 绕过、Defender 绕过、Sentinel One 绕过、Elastic Defend、 Sysmon 规避、PPID spoof、Sleep mask、Process Hollowing、Reflective DLL。

2026-07-038.4k

name

competition-linux-credential-pivot

description

Competition Linux Credential Pivot

Use this skill when the decisive edge is Linux credential material and where that material is accepted.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

Separate credential storage from accepted privilege.
Record user, process, namespace, socket, key file, and service trust boundary before conclusions.
Keep artifact recovery, replay path, and resulting capability in one chain.
Distinguish local escalation from lateral host pivot.
Reproduce one minimal artifact-to-accepted-access path.

Workflow

1. Map Credential And Trust Artifacts

Record SSH keys, agent sockets, kubeconfigs, cloud tokens, service-account secrets, env vars, config files, and process memory clues.
Note sudoers rules, capabilities, setuid binaries, systemd unit context, and namespace boundaries.
Keep each artifact tied to owner, scope, and expected accepting service.

2. Prove Replay And Pivot

Show where key, token, socket, or secret is accepted: SSH, API, Unix socket, container runtime, or control-plane endpoint.
Record host target, protocol, principal, and resulting session or privilege.
Distinguish authentication success from useful capability gain.

3. Reduce To Decisive Linux Pivot Chain

Compress to: recovered artifact -> accepted replay path -> pivot host or privilege transition -> resulting capability.
State whether root cause is weak key handling, token leakage, socket trust, sudo or capability abuse, or namespace crossover.
If the chain pivots into kernel exploit boundaries, hand off to kernel container escape skill.

Read This Reference

Load references/linux-credential-pivot.md for artifact checklists, replay matrix, and evidence packaging.

What To Preserve

Artifact path, owner, scope, accepting service, and resulting principal
Exact pivot order with protocol and target host or namespace
One minimal replayable chain proving capability gain