Security Applications of Reverse-Skill in Active Directory Environments

The reverse-skill framework provides a modular, routing-driven workflow for Active Directory security assessments, enforcing deterministic, auditable processes across enumeration, exploitation, and reporting phases.

The reverse-skill repository by zhaoxuya520 implements a specialized security framework designed for structured AD engagements. Its architecture separates routing logic from execution, ensuring that every Active Directory task follows a predefined, evidence-based pipeline suitable for both red-team operations and blue-team detection validation.

How Reverse-Skill Routes to AD-Specific Workflows

When analysts mention AD-related terms such as "Kerberoast," "AD CS," or "BloodHound," the central routing matrix in skills/routing.md matches the target type Windows AD and directs requests to the dedicated module at [skills/windows-ad/SKILL.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/windows-ad/SKILL.md). This routing decision occurs before any command execution, eliminating tool misselection and ensuring proper authorization checks.

The routing system operates as a deterministic filter: queries hitting row 78 of routing.md automatically trigger the AD skill's initialization sequence, which includes mandatory case scoping and network profile validation (lines 10-13 of windows-ad/SKILL.md).

Built-In AD Attack Path Reference

The framework bundles a concise attack-path reference at skills/windows-ad/references/ad-attack-paths.md that maps common AD techniques to prerequisites and preferred tooling:

Technique	Prerequisite	Primary Tool
Kerberoast	SPN-registered account	GetUserSPNs / Rubeus
AS-REP Roast	No pre-authentication required	GetNPUsers
ESC-1 (certificate abuse)	Registerable template + forgeable SAN	Certipy
ESC-8 (enrollment relay)	HTTP enrollment endpoint vulnerable to relay	ntlmrelayx
ACL → DA escalation	GenericAll on user or group	BloodHound
NTLM Relay	Unsigned authentication traffic	Responder + relay

This reference table is displayed inline during skill execution, making community-validated techniques instantly searchable without context-switching to external documentation.

Six-Phase AD Assessment Workflow

According to docs/ARCHITECTURE.md, the reverse-skill framework implements a Skill → Routing → Tool Index → Execution loop. The AD skill specifically follows this structured progression:

1. Authorization & Scoping

Every engagement begins with mandatory "case-init" and network profile checks. Lines 10-13 of windows-ad/SKILL.md enforce this gate, preventing unauthorized operations against production environments.

2. Enumeration

The skill supports multiple data collection methods:

• Impacket via nxc smb for host and share enumeration
• BloodHound (bloodhound-python) for graph-based relationship mapping
• Native PowerShell cmdlets for domain-joined system queries

3. Path Scoring

BloodHound graphs are consulted to rank privilege-escalation routes by exploitability and impact (line 39 of SKILL.md). This quantitative approach prevents analysts from chasing low-value attack paths.

4. Exploitation

The framework orchestrates multiple attack vectors:

• Kerberoasting and AS-REP roasting for credential extraction
• AD CS abuse via Certipy (ESC-1, ESC-8)
• NTLM relay attacks
• ACL manipulation for access control escalation

5. Evidence Capture

Every command execution is recorded as "Evidence" (line 54), creating immutable audit trails for compliance and legal proceedings. This evidence-first approach distinguishes reverse-skill from ad-hoc penetration testing toolchains.

6. Self-Check & Documentation

The skill concludes with a mandatory checklist (lines 80-84) verifying proper documentation, scope compliance, and artifact preservation. Results are written to field-journal with full reports generated via docs-generator.

Practical Command Examples

After framework routing completes, analysts execute standardized commands from the AD skill's toolchain. All listed utilities are auto-installed via bootstrap-reverse.ps1 if missing from the environment.

Domain Enumeration with Impacket

nxc smb <IP-range> -u <user> -p <pass>

Enumerates SMB shares, local users, and operating system versions across reachable hosts.

BloodHound Data Collection

bloodhound-python -d <domain> -u <user> -p <pass> -c All -ns <DC-hostname>

Gathers group membership, session, ACL, and trust data for Neo4j graph analysis.

Kerberoasting with Rubeus

Rubeus.exe kerberoast /domain:<domain>

Extracts service ticket hashes for SPN-registered accounts. These hashes are offline-crackable with Hashcat.

AS-REP Roasting

GetNPUsers.exe /output:asrep.txt /domains:<domain>

Retrieves AS-REP responses from accounts with Do Not Require Pre-Authentication enabled—typically service accounts or legacy configurations.

AD CS Template Abuse

certipy.exe request -template <TemplateName> -san <attacker-SAN>

Abuses misconfigured certificate templates to obtain forged certificates for authentication bypass (ESC-1 attack path).

NTLM Relay Operations

responder -I <iface> -wrf

ntlmrelayx.py -tf targets.txt -smb2support

Captures NTLM hashes from multicast name resolution protocols and relays them to vulnerable services.

All commands execute only after case scope validation permits the operation.

Integration with Broader Security Operations

The AD skill occupies the "Windows AD / Kerberos / AD CS" column in the routing matrix and composes with other reverse-skill modules:

• attack-chain/ — Multi-stage attack orchestration
• pentest-tools/ — Lateral movement automation
• threat-hunting/ — Blue-team detection workbook generation

This modularity eliminates custom glue code, allowing security teams to build end-to-end engagement pipelines from standardized components.

Training and CTF Applications

The same AD module powers the CTF orchestrator at CTF-Sandbox-Orchestrator/competition-identity-windows/SKILL.md, enabling safe hands-on training in isolated environments. This reuse ensures that procedures validated in production assessments remain available for skill development without environment drift.

Summary

• Deterministic routing via skills/routing.md guarantees AD tasks always execute through the specialized module
• Attack-path reference at ad-attack-paths.md centralizes technique-to-tool mappings for rapid lookup
• Six-phase workflow enforces authorization, enumeration, scoring, exploitation, evidence capture, and documentation
• Evidence-first architecture supports legal compliance and post-engagement reporting requirements
• Modular composition with attack-chain/, pentest-tools/, and threat-hunting/ enables full-spectrum security operations
• CTF sandbox reuse provides safe training environments using production-validated procedures

Frequently Asked Questions

How does reverse-skill prevent unauthorized AD exploitation?

The framework enforces "Read the SKILL.md before acting" (routing step 6 in routing.md) combined with mandatory case-init validation at lines 10-13 of windows-ad/SKILL.md. No commands execute until network profiles and authorization scopes are confirmed, creating deterministic safety gates unsuitable—by design—for rapid, uncontrolled exploitation.

What tools does the AD skill automatically manage?

The skill maintains a toolchain index covering BloodHound, Certipy, Impacket, Rubeus, Responder, and companion utilities. Missing binaries trigger automatic installation via bootstrap-reverse.ps1, ensuring consistent tool availability across engagement environments without manual dependency resolution.

Can reverse-skill support both offensive and defensive AD operations?

Yes. The same routing and evidence infrastructure serves red-team attack path validation and blue-team detection engineering via the threat-hunting/ module. BloodHound graphs generated during offensive phases become baselines for defensive coverage gap analysis, and the evidence system supports incident response documentation standards.

How does the attack-path reference stay current with evolving AD techniques?

The ad-attack-paths.md file follows a community-validated update model: techniques are added when validated against test domains, with prerequisite conditions and tool versions explicitly recorded. This creates searchable, version-controlled documentation rather than static knowledge that decays as AD security evolves.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}