DPAPI Credential Chain (CTF)
Traces how Windows DPAPI-protected secrets get unwrapped and accepted, inside CTF sandbox work
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 3 files
What it does
This is a specialist instruction set for an AI agent working on capture-the-flag style security exercises on Windows. When active, the agent maps DPAPI-protected secrets (Windows' built-in data-protection encryption) to the masterkey and user or machine context that can unwrap them, and then checks where the recovered plaintext is accepted. It is designed as a downstream step that only runs after a parent skill, ctf-sandbox-orchestrator, has set up sandbox assumptions. The skill's guidance is written as a workflow and checklist, and it asks the agent to reply in Simplified Chinese unless English is requested.
Great for
- Security students or competitors working on sanctioned CTF or lab exercises involving Windows credential storage
- Red-team trainers building or reviewing Windows credential-chain labs inside an isolated sandbox
- Analysts who already use the parent ctf-sandbox-orchestrator skill and need this narrower DPAPI workflow
Skip it if
- Use against systems you do not own or have written authorization to test, because the skill's purpose is recovering browser and vault credentials and replaying them; this is unlawful without permission
- Users new to security who have no sandbox or lab, since the skill assumes an established sandbox and will not set one up safely on its own
- General Windows administration or password recovery for your own accounts, where standard Windows tools or vendor documentation are more appropriate
Try asking
- “In my CTF sandbox, I have a DPAPI masterkey and a browser credential store on the Windows node. Map the blob, the unwrap context, and the accepting service.”
- “Explain how this DPAPI-protected Credential Manager entry becomes an accepted login in the lab, step by step.”
- “Trace whether a domain backup key was used to decrypt this vault blob in the competition scenario.”
- “Reduce this credential chain to the smallest proof path from protected artifact to accepted access.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the MIT licence and an attribution note.
competition-dpapi-credential-chain.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip competition-dpapi-credential-chain.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip competition-dpapi-credential-chain.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only use it inside an isolated, authorized lab, and state the scope and assumptions before asking for analysis
- Start by invoking the parent ctf-sandbox-orchestrator skill so the sandbox context is established, otherwise this skill tells the agent to route back
- Ask for the smallest proof chain rather than broad credential harvesting, since the skill is built to produce concise evidence
What's inside
- agents/openai.yaml
- references/dpapi-credential-chain.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.