菜单
Root pointer for the binary reversing lane. Covers triage, string extraction, packer unpacking, symbol risk, ROP, Ghidra deep analysis, and firmware extraction.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Benchmark mode marker — engagement objective is flag capture. Generic engagement rules apply unchanged.
Exploit Active Directory Certificate Services ESC1 — vulnerable template allows arbitrary SAN, enabling user impersonation up to domain admin.
BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.
NetExec (CrackMapExec successor) — unified SMB/LDAP/MSSQL/WinRM/RDP/SSH/FTP/VNC protocol auth + post-auth modules. 200+ modules incl. BloodHound auto-ingest, ESC1-15 scanning, PrintNightmare, LDAP relay.
Active Directory attack lane — BloodHound ingestion, Kerberoasting, ADCS ESC scanning, DCSync, LAPS extraction.
Red team engagement lifecycle management — initiation, phase transitions, go/no-go gates, deconfliction, emergency procedures, completion.
| name | reverser |
| description | Root pointer for the binary reversing lane. Covers triage, string extraction, packer unpacking, symbol risk, ROP, Ghidra deep analysis, and firmware extraction. |
| Skill | Use for |
|---|---|
/skills/standard/reverser/triage/SKILL.md | First-pass ELF/PE/Mach-O triage |
/skills/standard/reverser/firmware/SKILL.md | Router / IoT firmware extraction |
/skills/standard/reverser/packer-unpacking/SKILL.md | UPX / ASPack / Themida / VMProtect |
/skills/standard/reverser/rop-chain/SKILL.md | Gadget hunting for exploit dev |
/skills/standard/reverser/anti-debug-bypass/SKILL.md | IsDebuggerPresent, ptrace, NtGlobalFlag |
/skills/standard/reverser/ghidra/SKILL.md | Deep Ghidra analysis — decompile, xrefs, imports, P-code |
ghidra_status — check Ghidra MCP bridge and headless availabilitybin_identify — format, arch, NX/PIEbin_packer — entropy + signaturebin_strings — category=url/ip/crypto/secret/version to seed the graphbin_symbols_report — risk bucket classificationcve_lookup + cve_by_packageghidra_analyze for full analysis, or bin_ghidra_script / bin_r2_script as fallbackghidra_decompile on interesting functions, ghidra_xrefs on dangerous imports