SkillsAdd

zhaoxuya520/reverse-skill

windows-ad

Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.

Trending #7107 First seen Jul 18, 2026

Installation

$ npx skills add zhaoxuya520/reverse-skill --skill windows-ad
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

flutter-setting-up-on-windows Similar name
flutter/agent-plugins

Sets up a Windows environment for Flutter development. Use when configuring a Windows machine t…

7.8K installs
windows-builder Similar name
hashicorp/agent-skills

Build Windows images with Packer using WinRM communicator and PowerShell provisioners. Use when…

2.3K installs
windows-desktop-e2e Similar name
affaan-m/ecc

E2E testing for Windows native desktop apps (WPF, WinForms, Win32/MFC, Qt) using pywinauto and …

5.1K installs
windows-av-evasion Similar name
yaklang/hack-skills

>- AV/EDR evasion playbook for Windows. Use when bypassing AMSI, ETW, .NET assembly detection, …

2.9K installs
windows-privilege-escalation Similar name
yaklang/hack-skills

>- Windows local privilege escalation playbook. Use when you have low-privilege shell access on…

2.9K installs
windows-lateral-movement Similar name
yaklang/hack-skills

>- Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, …

2.8K installs

Also in this package

Other skills from zhaoxuya520/reverse-skill · top by installs.

npx skills add zhaoxuya520/reverse-skill
reverse-engineering 1.1K apk-reverse 14 ida-reverse 13 pentest-tools 12 radare2 12 binary-diff 13 diagram-generator 14 firmware-pentest 12 edr-bypass-re 13 patch-diff-exploit 14

Browse all from zhaoxuya520/reverse-skill

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Also listed on

Alternate registries and mirrors of this skill.

Repository health

Stars 35.1K
License LICENSE
Default branch main
Open issues 2
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 2,558 B
  • docs SUMMARY.md 181 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 614 installs

SKILL.md

Windows / Active Directory Security

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 ../field-journal/precedent-pentest.md
  2. NOW: 域/AD 测试必须明确授权范围（含 DC、是否允许投毒/中继）
  3. NOW: case-init；network_profile 与禁止动作写清
  4. NEXT: tool-index（impacket/certipy/bloodhound 等常手动）
  5. ACT: 从身份枚举与 BloodHound 图开始，不先上破坏性利用

适用场景

  • 域渗透、Kerberoasting、AS-REP、委派
  • AD CS（ESC1–ESC8 等）证书攻击
  • BloodHound / SharpHound 攻击路径
  • NTLM Relay / Coercer 强制认证
  • 本地提权到域路径（Potato 等作为跳板）

与 attack-chain 关系

  • 多阶段从外网到域控 → PRIMARY 可仍是 attack-chain/，本 skill 为 AD 专科
  • 已在域内专注身份 → PRIMARY = 本 skill

工作流

1. 枚举

# 示例 Impacket / 内置（需凭据与授权）
nxc smb <range> -u user -p pass
bloodhound-python -d domain.local -u user -p pass -c All -ns <DC>

2. 常见路径（先图后枪）

□ Kerberoast / AS-REP → 离线破解
□ ACL 滥用（GenericAll/WriteDacl）
□ 委派（非约束/约束/基于资源）
□ AD CS 模板错误 → Certipy
□ 中继：LLMNR/NBT-NS + ntlmrelayx（确认授权）

3. 凭证与横向

□ secretsdump / lsassy / mimikatz（严格授权与清理）
□ PtH / PtT / 黄金票仅在授权红队范围
□ 每步写 Evidence；高危等用户确认

工具链

工具 用途
BloodHound / SharpHound 路径图
Certipy AD CS
Impacket / NetExec 横向与枚举
Rubeus / Mimikatz 票据与凭证（授权）
Coercer / Responder 强制认证 / 投毒

参考

  • references/ad-attack-paths.md
  • ../pentest-tools/references/network-attack-defense.md
  • ../attack-chain/
  • seeds: field-journal/seed-005ad-certipy-esc1.md seed-007ntlm-relay-coercer.md seed-013_kerberoasting-spn.md

路由上下文

上游: MASTER R24 下游: 报告 docs-generator；需 EDR 研究 edr-bypass-re MUST NOT: 无授权 DCSync / 黄金票打生产

任务完成自检

  • 是否先有图/枚举再有利用？
  • 是否记录可复现命令并脱敏？
  • 是否遵守 scope 禁止项？
  • Checklist？