metasploit-cursor-harness: Skill for Cursor

LDAP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Active Directory targets: load internal-ad-pentest.

Ports and detection

Port	Service
389/tcp	LDAP (cleartext)
636/tcp	LDAPS (SSL/TLS)
3268/tcp, 3269/tcp	Global Catalog (AD)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/ldap_query",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 389, "ACTION": "RUN_SINGLE_QUERY", "QUERY_FILTER": "(objectClass=*)", "BASE_DN": "DC=<domain>,DC=<tld>"}
)

CLI fallback:

nmap -n -sV --script "ldap* and not brute" -p 389,636 <target>
ldapsearch -x -H ldap://<target> -s base -b "" namingContexts

Workflow

Task Progress:
- [ ] Anonymous/null bind testing
- [ ] Naming context and schema enumeration
- [ ] User/group/computer extraction
- [ ] bloodyAD / ldeep deep enum
- [ ] RBCD / shadow credentials checks
- [ ] Document findings

Anonymous / null bind

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/ldap_query",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 389,
    "ACTION": "RUN_SINGLE_QUERY",
    "QUERY_FILTER": "(objectClass=user)",
    "BASE_DN": "DC=<domain>,DC=<tld>",
    "USERNAME": "",
    "PASSWORD": ""
  }
)

CLI fallback:

ldapsearch -x -H ldap://<target> -D '' -w '' -b "DC=<domain>,DC=<tld>" "(objectClass=*)"
netexec ldap <DC_FQDN> -u '' -p '' --query "(objectClass=*)" ""
netexec ldap <DC_FQDN> -u '' -p '' --query "(sAMAccountName=*)" ""

Authenticated enumeration

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/ldap_query",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 389,
    "ACTION": "RUN_SINGLE_QUERY",
    "QUERY_FILTER": "(objectClass=user)",
    "BASE_DN": "DC=<domain>,DC=<tld>",
    "USERNAME": "DOMAIN\\user",
    "PASSWORD": "<pass>"
  }
)
msf_run_auxiliary_module(
  module_name="auxiliary/gather/ldap_passwords",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "DOMAIN\\user", "PASSWORD": "<pass>", "BASE_DN": "DC=<domain>,DC=<tld>"}
)