How to use the LSASS Ticket Material (CTF) agent skill

What the skill makes the agent do

When the skill is active, the agent follows a fixed workflow for one question: which credential material on a Windows host can actually be reused against a host or service, and what does that reuse give access to. It maps the credential artifacts present (logon sessions with their LUIDs, ticket caches, package names, SSPs, DPAPI context, and service-account material), then separates the types that matter: passwords, NTLM hashes, TGTs, service tickets, delegated tickets, DPAPI secrets, plaintext and gMSA material.

The skill then asks the agent to prove acceptance. It checks where the material is accepted, such as SMB, WinRM, service ticket use, DPAPI unwrap, Schannel or another service logon, and records the SPN, target host, ticket flags, encryption type and resulting privilege or token change. The final output is meant to be one short chain: host artifact, extracted material, accepted replay or unwrap, resulting capability.

The source says the agent should reply in Simplified Chinese unless the user explicitly asks for English.

• Maps logon sessions, ticket caches and DPAPI context on the host
• Separates present material from material that is actually replayable
• Reduces findings to a minimal host-to-access chain
• Hands broader host-to-host pivoting back to a separate Windows pivot skill

Install the skill: download, unzip and place it

Download the ZIP for competition-lsass-ticket-material from the directory page. The package contains SKILL.md, agents/openai.yaml and references/lsass-ticket-material.md. Unzip it so the folder named competition-lsass-ticket-material sits inside a skills directory.

For a personal install, put the folder in ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder. The skill is also listed for upload in the Claude apps: open Settings, go to Capabilities, then Skills, and upload the skill there.

Install ctf-sandbox-orchestrator as well. This skill refers to it as a prerequisite and will not work as intended without it.

• Personal: ~/.claude/skills/competition-lsass-ticket-material/
• Project: .claude/skills/competition-lsass-ticket-material/ inside your project
• Claude apps: Settings -> Capabilities -> Skills -> upload

Trigger the skill with natural requests

The skill description lists the situations it should match. You do not need a special command; ask in plain terms about the credential problem on the lab host. The skill is meant to activate only after ctf-sandbox-orchestrator has been used and has routed the task here, so start your session with that skill first.

Requests that match the description include asking the agent to inspect LSASS memory, recover tickets or logon sessions, trace DPAPI or SSP material, decide which credential artifacts are replayable, or connect host-resident credential material to an accepted pivot or privilege edge.

• Inspect the LSASS memory artifact from this lab host and list the logon sessions by LUID.
• Which Kerberos tickets in this cache are replayable against the file server SPN?
• Trace where the DPAPI-protected secret on this box is used and whether the service accepts it.
• Of the credentials we recovered, which are passwords, hashes, tickets or tokens, and which can be reused?
• Connect the recovered TGT to the privilege edge we already accepted on the target.

What the skill needs before it runs

The skill needs two things: an installed ctf-sandbox-orchestrator skill, and access to the competition sandbox environment and its target hosts. Without the sandbox, the agent has no host artifacts to analyse, so the skill cannot produce a result.

According to the listing, the skill does not run scripts and does not use the network. Its work is reasoning and analysis over the material you give it in the session and the checklist in its reference file.

• Requires: ctf-sandbox-orchestrator installed and active
• Requires: access to the competition sandbox and target hosts
• Runs scripts: no
• Uses network: no

Safety notes before you use it

This skill is focused on extracting and replaying credentials from LSASS and ticket caches. Use it only on systems you have explicit written authorisation to test, such as a CTF challenge, a lab you built, or a training range. Do not point it at real or production systems. It is not a general Windows hardening or incident response guide, because its text is oriented toward extraction and replay rather than defence.

The skill lists several items it does not cover in full detail, including the other skills and reference files it points to. Review those yourself before relying on them, and treat the listing's assessment as a summary, not a full audit.

• Only use on authorised CTF, lab or training systems
• Not suited to production systems or incident response
• Keep the evidence chain for each replay claim so results can be verified

Tips for getting useful results

Give the agent the host context first: which logon session, which account, which ticket cache, and which target service you are testing. The skill's checklist asks for these details, and conclusions drawn from mixed sessions and caches are a known pitfall it warns about.

Ask for the replay proof, not just the list. A secret being present does not make it replayable. Ask the agent to name the accepting service and the resulting logon or privilege change.

• Name the logon session (LUID) and cache source in your request
• Ask which service accepts each item, not only what was found
• Use the separate DPAPI skill for masterkey, vault or browser store questions