Skip to content
Get packs

LSASS Ticket Material (CTF)

Guides CTF-sandbox analysis of Windows LSASS credential material and proving which extracted secrets are replayable.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist instruction set for an AI agent working on capture-the-flag style security competitions inside a sandbox. Once installed, when a user asks about Windows logon sessions, Kerberos ticket caches, DPAPI-protected secrets or LSASS memory, the agent follows a fixed workflow: it maps which credential artifacts exist, distinguishes which ones (passwords, hashes, tickets, tokens) can actually be reused against a host or service, and reduces the result to a short chain from host artifact to accepted access. It is written as a downstream module that only applies after a parent skill (ctf-sandbox-orchestrator) has already set sandbox assumptions, and it tells the agent to reply in Simplified Chinese unless English is requested.

Great for

  • Security students or competitors working on authorised CTF or lab Windows challenges
  • Red-team trainers building reproducible lab exercises about credential replay
  • Users already running the ctf-sandbox-orchestrator skill who need a Windows credential specialisation

Skip it if

  • Real or production systems without explicit written authorisation, because the skill is focused on extracting and replaying credentials from LSASS and ticket caches
  • Users who only need general Windows hardening or incident response, since the text is oriented to extraction and replay rather than defence
  • Anyone expecting a standalone tool: the skill refers to other skills and a reference file that were not reviewed in full detail here

Try asking

  • “Inspect LSASS-resident material on this CTF Windows host and list the logon sessions and LUIDs involved”
  • “Trace which recovered Kerberos ticket is accepted by the SMB target in this sandbox lab”
  • “Distinguish which of these extracted artifacts (hash, TGT, DPAPI secret) is actually replayable on this path”
Step-by-step guide: how to use LSASS Ticket Material (CTF)Install, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-lsass-ticket-material.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-lsass-ticket-material.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-lsass-ticket-material.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only invoke it inside an authorised sandbox after the parent orchestrator skill is active; the description says it should not be used standalone
  • Provide the target service, host and session context up front so the agent can record SPNs, LUIDs and encryption types as the workflow requires
  • For DPAPI-specific questions, the skill itself recommends the separate competition-dpapi-credential-chain skill instead

What's inside

  • agents/openai.yaml
  • references/lsass-ticket-material.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.