This will do the trick:
It's a series of positive lookaheads, which all verify a match without consuming any characters. Then the length validation consumes the entire string, if it's the correct length.
Match capital or special (this depends on your definition of "special"):
Match lowercase letter:
Verify length (this is where you would also restrict any invalid characters):