Windows Ad

CommunityPopular

zhaoxuya520

windows-ad

Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.

Overview

Publisher	zhaoxuya520
Repository	`reverse-skill`
Skill name	`windows-ad`
Stars	41K
Forks	5.8K
Bundled files	1
License	MIT
Links	Skill source Repository

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
1 bundled files
Scripts, templates, and references the model can read while it works. Files are read-only and never executed.
Open source
Published by zhaoxuya520 on GitHub. Read the source before you install it.

Installation

Install the Windows Ad AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/windows-ad
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/zhaoxuya520/reverse-skill.git /tmp/reverse-skill
mkdir -p .claude/skills
cp -r /tmp/reverse-skill/skills/windows-ad .claude/skills/windows-ad

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Windows Ad in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Windows Ad on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Windows Ad is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Windows / Active Directory Security

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 ../field-journal/precedent-pentest.md
NOW: 域/AD 测试必须明确授权范围（含 DC、是否允许投毒/中继）
NOW: case-init；network_profile 与禁止动作写清
NEXT: tool-index（impacket/certipy/bloodhound 等常手动）
ACT: 从身份枚举与 BloodHound 图开始，不先上破坏性利用

适用场景

域渗透、Kerberoasting、AS-REP、委派
AD CS（ESC1–ESC8 等）证书攻击
BloodHound / SharpHound 攻击路径
NTLM Relay / Coercer 强制认证
本地提权到域路径（Potato 等作为跳板）

与 attack-chain 关系

多阶段从外网到域控 → PRIMARY 可仍是 attack-chain/，本 skill 为 AD 专科
已在域内专注身份 → PRIMARY = 本 skill

工作流

1. 枚举

bash
# 示例 Impacket / 内置（需凭据与授权）
nxc smb <range> -u user -p pass
bloodhound-python -d domain.local -u user -p pass -c All -ns <DC>

2. 常见路径（先图后枪）

text
□ Kerberoast / AS-REP → 离线破解
□ ACL 滥用（GenericAll/WriteDacl）
□ 委派（非约束/约束/基于资源）
□ AD CS 模板错误 → Certipy
□ 中继：LLMNR/NBT-NS + ntlmrelayx（确认授权）

3. 凭证与横向

text
□ secretsdump / lsassy / mimikatz（严格授权与清理）
□ PtH / PtT / 黄金票仅在授权红队范围
□ 每步写 Evidence；高危等用户确认

工具链

工具	用途
BloodHound / SharpHound	路径图
Certipy	AD CS
Impacket / NetExec	横向与枚举
Rubeus / Mimikatz	票据与凭证（授权）
Coercer / Responder	强制认证 / 投毒

参考

references/ad-attack-paths.md
../pentest-tools/references/network-attack-defense.md
../attack-chain/
seeds: field-journal/seed-005_ad-certipy-esc1.md seed-007_ntlm-relay-coercer.md seed-013_kerberoasting-spn.md

路由上下文

上游: MASTER R24
下游: 报告 docs-generator；需 EDR 研究 edr-bypass-re
MUST NOT: 无授权 DCSync / 黄金票打生产

任务完成自检

是否先有图/枚举再有利用？
是否记录可复现命令并脱敏？
是否遵守 scope 禁止项？
Checklist？

Bundled files

The model reads these on demand while the skill is loaded. They are exposed as readable files and are never executed.

references/ad-attack-paths.md1 KB

Frequently asked questions

What does the Windows Ad AI skill do?

Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.

Why use Windows Ad on TypingMind?

Because you install it once and use it with any model. Windows Ad is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Windows Ad in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/zhaoxuya520/reverse-skill/tree/main/skills/windows-ad. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use Windows Ad?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Windows Ad?

As many as you like. As long as a model supports skills, you can use Windows Ad with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Windows Ad AI skill free?

Yes. It is published on GitHub by zhaoxuya520 under the MIT license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Apple Notes

openclaw

OrganizationPopular

Create, view, edit, delete, search, move, or export Apple Notes via the memo CLI on macOS.

Bear Notes

Create, search, and manage Bear notes via grizzly CLI.

Gog

Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

Healthcheck

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Windows / Active Directory Security

ACTION REQUIRED（读完后立刻执行）

适用场景

与 attack-chain 关系

工作流

1. 枚举

2. 常见路径（先图后枪）

3. 凭证与横向

工具链

参考

路由上下文

任务完成自检

Bundled files

Frequently asked questions

Related AI Skills

Set up your own AI workspace now