saber: manuales cosechados e indice publico pre-construido

- manuales.py cosecha el --help de las herramientas que no traen man page
  (ffuf, sqlmap, suite impacket, netexec, hydra...) y lo escribe como markdown
  en conocimiento/09 - Manuales/. Es la referencia de opciones que la man page
  no da; complementa el cheatsheet de invocaciones comunes.
- indexa.py --publico construye saber-publico.jsonl: glosario + pack de
  conocimiento con los vectores ya calculados, 100% publico y portable.
- busca.py usa ese indice publico como fallback cuando no hay indice personal,
  asi un clon recien hecho consulta al instante sin reindexar nada.
- .gitignore deja pasar saber-publico.jsonl; el personal (saber.jsonl) sigue
  fuera.
- docs/rag.md y el README del pack documentan ambas cosas.

nucleo/saber/conocimiento/09 - Manuales/impacket-wmiexec.md

@@ -0,0 +1,61 @@
+# impacket-wmiexec — manual
+
+Salida de `impacket-wmiexec -h`, capturada de la propia herramienta. Referencia completa de opciones (las invocaciones del dia a dia estan en el cheatsheet de comandos).
+
+```
+Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
+
+usage: wmiexec.py [-h] [-share SHARE] [-nooutput] [-ts] [-silentcommand]
+                  [-debug] [-codec CODEC] [-shell-type {cmd,powershell}]
+                  [-com-version MAJOR_VERSION:MINOR_VERSION]
+                  [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key]
+                  [-dc-ip ip address] [-A authfile] [-keytab KEYTAB]
+                  target [command ...]
+
+Executes a semi-interactive shell using Windows Management Instrumentation.
+
+positional arguments:
+  target                [[domain/]username[:password]@]<targetName or address>
+  command               command to execute at the target. If empty it will
+                        launch a semi-interactive shell
+
+options:
+  -h, --help            show this help message and exit
+  -share SHARE          share where the output will be grabbed from (default
+                        ADMIN$)
+  -nooutput             whether or not to print the output (no SMB connection
+                        created)
+  -ts                   Adds timestamp to every logging output
+  -silentcommand        does not execute cmd.exe to run given command (no
+                        output)
+  -debug                Turn DEBUG output ON
+  -codec CODEC          Sets encoding used (codec) from the target's output
+                        (default "utf-8"). If errors are detected, run
+                        chcp.com at the target, map the result with https://do
+                        cs.python.org/3/library/codecs.html#standard-encodings
+                        and then execute wmiexec.py again with -codec and the
+                        corresponding codec
+  -shell-type {cmd,powershell}
+                        choose a command processor for the semi-interactive
+                        shell
+  -com-version MAJOR_VERSION:MINOR_VERSION
+                        DCOM version, format is MAJOR_VERSION:MINOR_VERSION
+                        e.g. 5.7
+
+authentication:
+  -hashes LMHASH:NTHASH
+                        NTLM hashes, format is LMHASH:NTHASH
+  -no-pass              don't ask for password (useful for -k)
+  -k                    Use Kerberos authentication. Grabs credentials from
+                        ccache file (KRB5CCNAME) based on target parameters.
+                        If valid credentials cannot be found, it will use the
+                        ones specified in the command line
+  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256
+                        bits)
+  -dc-ip ip address     IP Address of the domain controller. If ommited it use
+                        the domain part (FQDN) specified in the target
+                        parameter
+  -A authfile           smbclient/mount.cifs-style authentication file. See
+                        smbclient man page's -A option.
+  -keytab KEYTAB        Read keys for SPN from keytab file
+```