CTF Campaign Driver

ctf-workflow

The driver is the plan. Run one command, do exactly what it prints, record the result, repeat. The gates are enforced by scripts/campaign.py.

The loop

python3 scripts/campaign.py next
python3 scripts/campaign.py note <row> --arsenal <slug>
python3 scripts/campaign.py done <row> --poc <img> --kind req   # | --dead R | --park Q | --find F

Every next now prints an APPROACH:/AVOID:/REFS: block for the served row (the distilled ctf-box method for that vuln class) - read it before acting.

Start / resume

1. python3 scripts/campaign.py init --type ctf - validates scope.md (for a box, scope is just the target IP/host) + envelope.
2. OSINT is OFF by default for CTF (pass 0 is skipped). Only run it if this skill was invoked with an explicit osint argument - a box's answer is on the box, not in Wayback.
3. Passes 1-3 feed state.md - rustscan/nmap + web enum. Read every service banner, page source and config end to end.
4. python3 scripts/campaign.py board - writes the 4a foothold rows; once an asset is a foothold, re-run board and it seeds the 4b privesc rows (pspy/linpeas auto + the manual checklist) for that asset.
5. Enter the loop, depth-first.
6. When a foothold lands (a reverse shell in a tmux window via vm-scan.sh --win shell, or a meterpreter/msfconsole session via --win msf), record it: python3 scripts/campaign.py foothold <target> --win shell (or --win msf; or ride it on the closing find with done ... --win). The driver flips the asset's state.md row to access=foothold and routes its 4b privesc rows through vm-rsh --win <win> (persistent session + operator visibility past foothold), and prints tmux attach -t <eng> for manual takeover. msf itself is operator-attach / drop-to-shell, not vm-rsh-driven (its wrapper frames a bash shell, not the msf6 > REPL). After recording a foothold, re-run python3 scripts/campaign.py board so the 4b privesc rows are seeded - next will not surface them until you do.
7. Web RCE -> a real shell, THEN stabilize -- do not ride one-liners (recurring drift). The moment code-exec lands (a web-RCE primitive, an LFI->session-poison, a deser gadget), STOP hand-poking one-shot payloads: (a) catch it with a real handler by default - msfconsole's exploit/multi/handler (meterpreter first; a plain shell_reverse_tcp is the backup when meterpreter is blocked, e.g. Windows/EDR) (record via campaign.py foothold <target> --win msf, step 6). Reserve a raw nc -lvnp listener for when msf is unavailable: a raw nc pane's Ctrl-C kills the LISTENER (dropping the shell back to your own prompt, the false-root attacker-prompt trap) and it has no session management, while meterpreter also carries post/multi/recon/local_exploit_suggester escalation modules and built-in file transfer. (b) Before picking the LPORT, test target egress on common ports (80/443/53) - high ports like 4444 are frequently filtered, so pick an egress-allowed LPORT. (scripts/vm-handler.sh <eng> <lhost> picks a free egress port and launches the handler for you, printing the LPORT.) (c) If you did fall back to raw nc, stabilize it immediately with bash scripts/vm-stabilize.sh --win shell <eng> (pty + job control + window size). (d) Then record the foothold (step 6) and drive with vm-rsh. An unstabilized nc shell (no job control, mid-line wrapping) is what makes post-ex drift back into one-liners. Full discipline: Skill(ctf-box) Phase 3 (Deliver). The recon-capture hook fires this reflex once on the first service-account id.

Box recipes

ctf-workflow owns pass sequencing and the board; the per-service exploitation recipes live in Skill(ctf-box), which the driver hands off to - do not duplicate them here. Route a fingerprinted service to its Skill(hunt-*) as the board names it; use Skill(ctf-category) for a standalone challenge (pwn/rev/crypto/forensics/stego).