competition-kerberos-delegation

1# Competition Kerberos Delegation
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the hard part is not "is there Kerberos here," but which delegation edge exists, which ticket is being minted, and which service really accepts it.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Write the trust chain first: principal -> delegation edge -> ticket type -> target SPN -> accepting service -> resulting privilege.
122. Separate ticket possession from accepted privilege.
133. Keep SPNs, delegation mode, PAC/group data, encryption type, and service acceptance in one compact evidence block.
144. Reproduce one minimal delegation chain before broadening into variants.
155. Tie every privilege claim to a specific accepted ticket or service-side effect.
16 
17## Workflow
18 
19### 1. Identify The Delegation Edge
20 
21- Determine whether the path is constrained delegation, unconstrained delegation, resource-based constrained delegation, protocol transition, or another trust edge.
22- Inspect SPNs, ACLs, service accounts, SIDHistory, certificate templates, and replication rights only when they affect the active path.
23 
24### 2. Trace Ticket Minting And Acceptance
25…