Skip to content
Get packs

AD Certificate Abuse Playbook

Guides an agent through analyzing AD CS certificate templates and cert-based privilege paths inside a CTF sandbox.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a reference playbook that teaches an AI agent how to reason about Active Directory Certificate Services (AD CS): how certificate templates, enrollment rights, EKUs and subject/SAN settings can turn an issued certificate into accepted login privilege. It is designed as a downstream step inside a capture-the-flag (CTF) sandbox workflow and only activates after a parent skill, ctf-sandbox-orchestrator, has set up the sandbox assumptions. It mainly structures the agent's analysis and evidence-keeping; the files shown do not include executable scripts.

Great for

  • Security students or competitors working on CTF challenges that involve Windows AD CS
  • Penetration testers practicing certificate-based attack paths in an authorized lab
  • Security teams reviewing their own AD CS template configuration for misconfigurations

Skip it if

  • Attacking production or third-party networks, since the skill assumes a sanctioned sandbox and provides abuse-chain guidance that is harmful outside authorized testing
  • Users who want a general Windows administration or certificate setup guide, since the content is oriented toward exploitation paths rather than hardening
  • Use without the parent ctf-sandbox-orchestrator skill, since the skill itself says it should not be used on its own

Try asking

  • “Map the CA, certificate template and enrollment rights for this ESC-style challenge in my lab”
  • “Explain how an issued certificate with a SAN override gets accepted for PKINIT logon in this sandbox”
  • “Summarize the smallest enrollment-to-privilege chain and the evidence to record for the write-up”
Step-by-step guide: how to use AD Certificate Abuse PlaybookInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-ad-certificate-abuse.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-ad-certificate-abuse.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-ad-certificate-abuse.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide the sandbox scope and CA/template names up front so the agent stays within the authorized lab
  • Expect responses in Simplified Chinese by default; ask explicitly for English if needed
  • Pair it with the reference file for checklists, and verify any findings against your own lab's actual configuration

What's inside

  • agents/openai.yaml
  • references/ad-certificate-abuse.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.