Skip to content
Get packs

Competition Kerberos Delegation

Traces Kerberos delegation trust edges and ticket acceptance in sandboxed CTF exercises

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist add-on for a CTF (capture-the-flag security competition) sandbox orchestrator. Once the parent skill has set up the sandbox rules, this one guides the agent through analysing Kerberos delegation settings in a Windows-style test network: which delegation path exists, which ticket is requested, and which service actually accepts it. The agent is told to write out a replayable chain of steps and to separate ticket possession from proven privilege. It is written as an internal downstream component and replies in Simplified Chinese by default.

Great for

  • Competitors practising Active Directory and Kerberos attack paths in authorised CTF sandboxes
  • Security students learning how constrained, unconstrained and resource-based delegation work

Skip it if

  • Real corporate or production networks, because the skill assumes an authorised sandbox and could be misused to attack systems without permission
  • Users who have not first set up the parent ctf-sandbox-orchestrator skill, since it says it should only run after that skill has routed to it

Try asking

  • “Explain how a constrained delegation S4U chain in this sandbox leads to a service ticket being accepted”
  • “Compare unconstrained delegation and resource-based constrained delegation for the sandbox domain”
  • “Help me build a compact evidence block of SPNs, delegation mode and encryption type for this challenge”
Step-by-step guide: how to use Competition Kerberos DelegationInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-kerberos-delegation.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-kerberos-delegation.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-kerberos-delegation.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Load the parent orchestrator first, as the skill instructs, so sandbox assumptions are set before this one applies
  • Ask for one minimal delegation chain at a time rather than a broad sweep of the domain
  • Keep the evidence block (SPN, delegation mode, encryption type, accepting service) with every privilege claim

What's inside

  • agents/openai.yaml
  • references/kerberos-delegation.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.