Skip to content
Get packs

Windows Pivot Specialist

Traces Windows host-to-host movement and Kerberos/WinRM/SMB/RDP credential replay inside CTF sandboxes

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill gives an AI agent a specialist playbook for CTF (capture-the-flag) security competitions, focused on how an attacker-style exercise moves from one Windows machine to another. Once installed, the agent organizes evidence into a chain: which artifact was recovered, which protocol (WinRM, SMB, RDP) it was replayed over, which service accepted it, and what privilege appeared on the destination host. It is designed as a downstream add-on that only activates after a parent sandbox-orchestrator skill has set the assumptions and scope. The agent is also told to reply in Simplified Chinese unless English is requested.

Great for

  • CTF players working on Windows Active Directory challenges who need a structured pivot timeline
  • Security trainers building sandboxed lab exercises on lateral movement and Kerberos
  • Students learning how Kerberos tickets and delegation edges are traced in a controlled lab

Skip it if

  • Use against systems you do not own or have written authorization to test, since the content describes credential recovery and replay (risk of unauthorized access)
  • Production incident response on real networks, because the skill is written for a sandbox competition context and does not cover safe handling of live data
  • Users who only want general Windows administration help, since the content is focused on attacker-style privilege movement

Try asking

  • “Trace how a recovered Kerberos ticket was replayed over WinRM to a second host in my CTF sandbox”
  • “Build a pivot chain timeline from foothold to resulting admin session on the lab domain controller”
  • “Explain which service accepted the replayed credential and record its event IDs”
Step-by-step guide: how to use Windows Pivot SpecialistInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-windows-pivot.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-windows-pivot.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-windows-pivot.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Load the parent ctf-sandbox-orchestrator skill first, since this skill refuses to run standalone
  • Keep the sandbox scope and authorization explicit in your request so the agent stays within the lab
  • Ask for the timeline output separately from raw host artifacts to keep evidence clean

What's inside

  • agents/openai.yaml
  • references/windows-pivot.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.