reverse-skill/CTF-Sandbox-Orchestrator/competition-linux-credential-pivot/references/linux-credential-pivot.md

Linux Credential Pivot Checklist

First Pass

• SSH keys, agent sockets, kubeconfigs, cloud tokens, service-account secrets
• Env vars, config files, systemd units, sudoers, capabilities, setuid binaries
• Namespace context, container runtime sockets, control-plane endpoints

Chain To Reconstruct

1. Credential artifact recovered
2. Accepting service identified
3. Replay or auth path executed
4. New session, token, or privilege gained
5. Pivot or lateral effect reproduced

Evidence To Keep Together

• Artifact side: file or socket path, owner, scope, lifetime
• Replay side: target host, service, protocol, principal
• Effect side: privilege change, new shell, control-plane action, lateral movement

Common Pitfalls

• Listing secrets without proving acceptance on a target service
• Mixing local privilege escalation and lateral movement in one vague chain
• Ignoring namespace or socket ownership context