metasploit-cursor-harness: Skill for Cursor

Internal and AD Pentest

Prerequisites

• Confirm internal targets are in engagement ROE and scope CIDRs.
• Port/service discovery: load hacktricks-methodology.
• Cloud/DevOps from foothold: route to cloud-pentest or container-devops-pentest.

Phase model

Task Progress:
- [ ] Enumerate AD / internal network
- [ ] Credential access (spray, kerberos, relay, dumps)
- [ ] Privilege escalation (local then domain)
- [ ] Lateral movement and pivoting
- [ ] Domain dominance / data access
- [ ] Document and evidence

Phase 1: Enumeration

LDAP query

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/ldap_query",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USERNAME": "[email protected]", "PASSWORD": "password", "QUERY_FILTER": "(objectClass=user)", "QUERY_ATTRIBUTES": "sAMAccountName,memberOf"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ldap/ldap_login",
  engagement_id="<id>",
  options={"RHOSTS": "<dc>", "DOMAIN": "domain.local", "USERNAME": "user", "PASSWORD": "password"}
)

CLI fallback:

Get-DomainUser -Properties *
Get-DomainGroup -Properties *
Get-DomainComputer -Properties *
Get-DomainTrust

ldapsearch -x -H ldap://dc.domain.local -D "[email protected]" -w pass -b "DC=domain,DC=local" "(objectClass=user)"
enum4linux -a dc.domain.local

BloodHound collection

MSF: No direct module; use CLI.

CLI fallback:

.\SharpHound.exe -c All -d domain.local

bloodhound-python -d domain.local -u user -p pass -gc dc.domain.local -c all
certipy find -u [email protected] -p pass -dc dc.domain.local -bloodhound

Import JSON into BloodHound. Query: shortest path to Domain Admins, Kerberoastable users, AS-REP roastable, unconstrained delegation.

Share enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/smb/smb_enumshares",
  engagement_id="<id>",
  options={"RHOSTS": "10.10.10.0/24", "SMBUser": "user", "SMBPass": "password", "SMBDomain": "domain.local"}
)