Use this skill only as a downstream specialization after
$ctf-sandbox-orchestrator
is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to
$ctf-sandbox-orchestrator
first.
Use this skill when the decisive Windows secret is DPAPI-protected and the hard part is proving which context unwraps it and where the plaintext is accepted.
Reply in Simplified Chinese unless the user explicitly requests English.
Record blob source, masterkey location, SID, protector scope, profile path, credential store, and any application wrapper such as browser encryption or vault metadata.
Note whether the decisive value lives in Credential Manager, Vault, browser cookies, browser passwords, Wi-Fi profiles, RDP files, or custom app storage.
Keep protected artifact, masterkey candidate, and account or machine context tied together.
Show how the secret is decrypted: user logon material, machine context, domain backup key, or another recovered protector.
Record plaintext type, target host or service, replay method, and resulting session, token, or data access.
Distinguish successful blob decryption from actual accepted access.
演示机密的解密方式：用户登录凭证、设备上下文、域备份密钥或其他恢复得到的保护密钥。
记录明文类型、目标主机或服务、重放方法，以及最终获得的会话、令牌或数据访问权限。
区分 blob 成功解密与实际获得可被认可的访问权限的差异。
3. Reduce To The Decisive DPAPI Chain
3. 提炼为关键 DPAPI 链路
Compress the result to the smallest sequence: protected artifact -> masterkey or unwrap context -> plaintext secret -> accepted replay or access -> resulting capability.
State clearly whether the decisive edge lives in masterkey recovery, DPAPI scope confusion, application wrapper handling, or the service that accepts the recovered secret.
If the task broadens into generic LSASS ticket material or full Windows pivoting, hand back to the tighter host or pivot skill.