competition-kerberos-delegation
Lets your agent investigate Kerberos and how it manages permission delegation. Useful for understanding network access and privileges.
What it does
This tool helps understand how an attacker can use a specific type of authentication called 'Kerberos delegation' to gain access to systems. It focuses on how a credential can be passed from one service to another to gain privileges.
When to use it
- ✓When you want to understand how Kerberos delegation works.
- ✓When analyzing how an attacker can abuse delegation to escalate privileges.
- ✓To map trust chains and how they lead to unauthorized access.
Example of what to ask your AI
“How can unconstrained delegation be used to gain access to a file server?”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
It analyzes the Kerberos authentication steps, identifying the type of delegation, the tickets used, and which services accept these tickets to grant access.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill competition-kerberos-delegationOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/CTF-Sandbox-Orchestrator/competition-kerberos-delegation/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Competition Kerberos Delegation
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the hard part is not "is there Kerberos here," but which delegation edge exists, which ticket is being minted, and which service really accepts it.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Write the trust chain first: principal -> delegation edge -> ticket type -> target SPN -> accepting service -> resulting privilege.
- Separate ticket possession from accepted privilege.
- Keep SPNs, delegation mode, PAC/group data, encryption type, and service acceptance in one compact evidence block.
- Reproduce one minimal delegation chain before broadening into variants.
- Tie every privilege claim to a specific accepted ticket or service-side effect.
Workflow
1. Identify The Delegation Edge
- Determine whether the path is constrained delegation, unconstrained delegation, resource-based constrained delegation, protocol transition, or another trust edge.
- Inspect SPNs, ACLs, service accounts, SIDHistory, certificate templates, and replication rights only when they affect the active path.
2. Trace Ticket Minting And Acceptance
- Record TGT/TGS type, S4U steps when relevant, delegation flags, PAC or group data, encryption type, cache location, and target SPN.
- Prove which service actually accepts the ticket and what capability appears after acceptance.
3. Report The Effective Edge
- Compress the chain into one replayable path, not a vague "domain compromise" statement.
- Separate candidate edges from the edge that really lands privilege.
Read This Reference
- Load
references/kerberos-delegation.mdfor the delegation checklist, ticket fields to preserve, and common proof mistakes.
What To Preserve
- SPN, ticket type, delegation mode, PAC/group data, encryption type, cache location, accepting service
- Service-side logs, event IDs, logon session changes, or group changes proving effective privilege
- The exact trust edge that makes the ticket replayable
FAQ
What is Kerberos delegation?
It's an authentication feature that allows a service, after authenticating on behalf of a user, to act as that user to access other services.
What is an SPN?
SPN stands for Service Principal Name. It's a unique identifier for a service on a network.
What's the difference between constrained and unconstrained delegation?
Unconstrained delegation allows the service to use the user's credentials to access ANY service. Constrained delegation limits access to specific services.
Details
Original description by the author
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kerberos delegation, SPN trust edges, S4U abuse, RBCD, constrained or unconstrained delegation, and service-ticket acceptance. Use when the user asks about constrained delegation, unconstrained delegation, RBCD, S4U, SPNs, ticket acceptance, or how a Kerberos trust edge turns into effective privilege under sandbox ass
Popularity
- GitHub stars
- 42k
- Ranking position
- #4722
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC