competition-kerberos-delegationlisted

# Competition Kerberos Delegation Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first. Use this skill when the hard part is not "is there Kerberos here," but which delegation edge exists, which ticket is being minted, and which service really accepts it. Reply in Simplified Chinese unless the user explicitly requests English. ## Quick Start 1. Write the trust chain first: principal -> delegation edge -> ticket type -> target SPN -> accepting service -> resulting privilege. 2. Separate ticket possession from accepted privilege. 3. Keep SPNs, delegation mode, PAC/group data, encryption type, and service acceptance in one compact evidence block. 4. Reproduce one minimal delegation chain before broadening into variants. 5. Tie every privilege claim to a specific accepted ticket or service-side effect. ## Workflow ### 1. Identify The Delegation Edge - Determine whether the path is constrained delegation, unconstrained delegation, resource-based constrained delegation, protocol transition, or another trust edge. - Inspect SPNs, ACLs, service accounts, SIDHistory, certificate templates, and replication rights only when they affect the active path. ### 2. Trace Ticket Minting And Acceptance - Record TGT/TGS type, S4U steps when relevant, delegation flags, PAC or group da