ctf-workflow

The driver is the plan. Run one command, do exactly what it prints, record the result, repeat. The gates are enforced by scripts/campaign.py.

The loop

python3 scripts/campaign.py next
python3 scripts/campaign.py note <row> --arsenal <slug>
python3 scripts/campaign.py done <row> --poc <img> --kind req   # | --dead R | --park Q | --find F

Every next now prints an APPROACH:/AVOID:/REFS: block for the served row (the distilled ctf-box method for that vuln class) - read it before acting.

Start / resume

1. python3 scripts/campaign.py init --type ctf - validates scope.md (for a box, scope is just the target IP/host) + envelope.
2. OSINT is OFF by default for CTF (pass 0 is skipped). Only run it if this skill was invoked with an explicit osint argument - a box's answer is on the box, not in Wayback.
3. Passes 1-3 feed state.md - rustscan/nmap + web enum. Read every service banner, page source and config end to end.
4. python3 scripts/campaign.py board - writes the 4a foothold rows; once an asset is a foothold, re-run board and it seeds the 4b privesc rows (pspy/linpeas auto + the manual checklist) for that asset.
5. Enter the loop, depth-first.
6. When a foothold lands (a reverse shell in a tmux window via vm-scan.sh --win shell, or a meterpreter/msfconsole session via --win msf), record it: python3 scripts/campaign.py foothold <target> --win shell (or --win msf; or ride it on the closing find with done ... --win). The driver flips the asset's state.md row to access=foothold and routes its 4b privesc rows through vm-rsh --win <win> (persistent session + operator visibility past foothold), and prints tmux attach -t <eng> for manual takeover. msf itself is operator-attach / drop-to-shell, not vm-rsh-driven (its wrapper frames a bash shell, not the msf6 > REPL). After recording a foothold, re-run python3 scripts/campaign.py board so the 4b privesc rows are seeded - next will not surface them until you do.
7. Web RCE -> a real shell, THEN stabilize -- do not ride one-liners (recurring drift). The moment code-exec lands (a web-RCE primitive, an LFI->session-poison, a deser gadget), STOP hand-poking one-shot payloads: (a) catch it with a real handler by default - msfconsole's exploit/multi/handler (meterpreter first; a plain shell_reverse_tcp is the backup when meterpreter is blocked, e.g. Windows/EDR) (record via campaign.py foothold <target> --win msf, step 6). Reserve a raw nc -lvnp listener for when msf is unavailable: a raw nc pane's Ctrl-C kills the LISTENER (dropping the shell back to your own prompt, the false-root attacker-prompt trap) and it has no session management, while meterpreter also carries post/multi/recon/local_exploit_suggester escalation modules and built-in file transfer. (b) Before picking the LPORT, test target egress on common ports (80/443/53) - high ports like 4444 are frequently filtered, so pick an egress-allowed LPORT. (scripts/vm-handler.sh <eng> <lhost> picks a free egress port and launches the handler for you, printing the LPORT.) (c) If you did fall back to raw nc, stabilize it immediately with bash scripts/vm-stabilize.sh --win shell <eng> (pty + job control + window size). (d) Then record the foothold (step 6) and drive with vm-rsh. An unstabilized nc shell (no job control, mid-line wrapping) is what makes post-ex drift back into one-liners. Full discipline: Skill(ctf-box) Phase 3 (Deliver). The recon-capture hook fires this reflex once on the first service-account id.

Box recipes

ctf-workflow owns pass sequencing and the board; the per-service exploitation recipes live in Skill(ctf-box), which the driver hands off to - do not duplicate them here. Route a fingerprinted service to its Skill(hunt-*) as the board names it; use Skill(ctf-category) for a standalone challenge (pwn/rev/crypto/forensics/stego).

Browser observation

A box is VPN-boxed, so the local chrome-devtools MCP browser cannot reach it - use the VM-side browser (scripts/browser.sh <url> / capture.sh web) to render a JS-heavy web service and read its DOM + network requests (the rendered XHR/fetch calls reveal API routes a curl crawl misses - often the intended path). Rendered screenshots of the flag/exploited state are valid web PoCs.

A service needing a manual login / MFA / CAPTCHA the agent can't do headlessly -> Skill(chrome-devtools-browser): a VISIBLE chromium on the VM desktop (scripts/browser-visible.sh) the operator drives, observed live via the chrome-devtools MCP.

Gates

G1 arsenal-first, G2 skill-first, G3 typed evidence (a flag on screen is a valid web PoC), G8 tool-first. Privesc always includes pspy + linpeas/winpeas - the board seeds these as 4b rows once an asset is recorded as a foothold (re-run board after foothold/done --win to seed them).

Once a foothold and a working escalation vector are identified, hand the exploit compile + escalation run to a sub-agent via Skill(delegate) - checklist, model choice, and the mandatory false-root/false-RCE hostname+uid guardrail all live there; keep the main agent driving the board.

Prefer a clean post-ex command channel over driving msf sessions -c (delayed output, quoting pain): a webshell writing enum output to a web-served file then curl it, or a single-tool read/decrypt done locally on already-exfiltrated data.

Autonomy

No approvals. The verifier is optional for CTF (a captured flag self-verifies). Both flags captured -> set ## STATUS: SOLVED in state.md, then the driver prints the close-out chain.

Discipline

• Do NOT invoke superpowers:brainstorming/writing-plans mid-box; keep no parallel task list.
• One agent. Read service output whole - the foothold hides in the handler a grep skips.
• Reuse captured creds across hosts before researching new ones.
• Long/observed tools (sqlmap, big scans) go in a NAMED tmux window (scripts/vm-scan.sh), never a blind background pipe -- you must WATCH a scanner that can trip a target's rate-limiter/ban.
• Capture the flag/root state to poc/ AS IT LANDS (scripts/capture.sh), even on a curl/ssh-only box -- a transient exploited state cannot be re-shot after the turn.

Close-out

Run the printed chain: Skill(walkthrough) -> Skill(learn).

If the driver is unavailable

Manual fallback: read Approach.md, take the top open row, run its wiki lookup then its hunt skill or Skill(ctf-box), capture evidence, mark [x]; on exhaustion one Deadends.md line + [!].