reverse-skills-max/reverse-skill-repo/CTF-Sandbox-Orchestrator/competition-windows-pivot/references/windows-pivot.md

Windows Pivot And Kerberos Checklist

Pivot Chain

Write the chain explicitly:

• source host
• recovered artifact
• replay protocol or service
• destination host
• resulting capability

Kerberos Fields To Keep

• Ticket type
• SPN
• Delegation mode
• PAC or group data
• Encryption type
• Cache location
• Accepting service

Host Evidence To Keep

• Event IDs, logon IDs, process creation, service creation, task creation
• WinRM, SMB, RDP, WMI, admin-share, and remote-registry traces
• Group membership or token changes on the destination host

Common Pitfalls

• Treating possession of a ticket as proof of accepted privilege
• Saying a pivot worked without showing the destination-side effect
• Mixing several hops into one vague statement instead of a reproducible chain