What problem does it solve? In CTF sandbox challenges involving Windows environments, it is hard to prove exactly how an attacker moved between hosts: which credential or ticket was recovered, which service accepted it, and what privilege resulted. This Skill structures that analysis into a concrete, replayable pivot chain. ## Core Features & Use Cases - Replay Material Recovery: Guides inspection of SAM, SECURITY, SYSTEM, NTDS, DPAPI, LSA secrets, browser stores, and event logs to distinguish passwords, hashes, tickets, and gMSA material by where they can actually be used. - Pivot Chain Tracing: Maps the actual protocol used (WinRM, SMB, RDP, WMI, admin shares, remote registry) and records Kerberos details like SPN, delegation mode, PAC data, encryption type, and the accepting service. - Evidence Reporting: Keeps host evidence, ticket evidence, and privilege effects on one timeline so every replayed artifact is tied to a concrete destination-side capability. - Use Case: During a CTF, you recover a Kerberos ticket from one host and need to prove it grants access to a second host via WinRM. This Skill walks you through recording the SPN, the accepting service, and the resulting logon session as a reproducible chain. ## Quick Start After the ctf-sandbox-orchestrator has established sandbox assumptions, ask it to trace the Windows pivot chain from the foothold host and identify which service accepted the replayed Kerberos ticket.
