reverse-skills-max: initial public release (restored, redacted, hardened)

reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-linux-credential-pivot/references/linux-credential-pivot.md

@@ -0,0 +1,27 @@
+# Linux Credential Pivot Checklist
+
+## First Pass
+
+- SSH keys, agent sockets, kubeconfigs, cloud tokens, service-account secrets
+- Env vars, config files, systemd units, sudoers, capabilities, setuid binaries
+- Namespace context, container runtime sockets, control-plane endpoints
+
+## Chain To Reconstruct
+
+1. Credential artifact recovered
+2. Accepting service identified
+3. Replay or auth path executed
+4. New session, token, or privilege gained
+5. Pivot or lateral effect reproduced
+
+## Evidence To Keep Together
+
+- Artifact side: file or socket path, owner, scope, lifetime
+- Replay side: target host, service, protocol, principal
+- Effect side: privilege change, new shell, control-plane action, lateral movement
+
+## Common Pitfalls
+
+- Listing secrets without proving acceptance on a target service
+- Mixing local privilege escalation and lateral movement in one vague chain
+- Ignoring namespace or socket ownership context